Geo-fencing in a wireless location system

ABSTRACT

Method and systems are employed by a wireless location system (WLS) for locating a wireless device operating in a geographic area served by a wireless communications system. An exemplary method includes defining a geo-fenced area. The method then includes monitoring a set of predefined signaling links of the wireless communications system, and detecting that a mobile device has performed any of the following acts with respect to the geo-fenced area: (1) entered the geo-fenced area, (2) exited the geo-fenced area, and (3) come within a predefined degree of proximity near the geo-fenced area. A high-accuracy location function may then be triggered in order to determine the geographic location of the mobile device.

CROSS REFERENCE

This application is a continuation of U.S. application Ser. No.11/150,414, filed Jun. 10, 2005, entitled “Advanced Triggers forLocation-Based Service Applications in a Wireless Location System” (theentirety of which is hereby incorporated by reference), which is acontinuation-in-part of U.S. application Ser. No. 10/768,587, filed Jan.29, 2004, entitled “Monitoring of Call Information in a WirelessLocation System”, now pending, which is a continuation of U.S.application Ser. No. 09/909,221, filed Jul. 18, 2001, entitled“Monitoring of Call Information in a Wireless Location System,”, nowU.S. Pat. No. 6,782,264 B2, which is a continuation-in-part of U.S.application Ser. No. 09/539,352, filed Mar. 31, 2000, entitled“Centralized Database for a Wireless Location System,” now U.S. Pat. No.6,317,604 B1, which is a continuation of U.S. application Ser. No.09/227,764, filed Jan. 8, 1999, entitled “Calibration for WirelessLocation System”, now U.S. Pat. No. 6,184,829 B1.

TECHNICAL FIELD

The present invention relates generally to methods and apparatus forlocating wireless devices, also call mobile stations (MS), such as thoseused in analog or digital cellular systems, personal communicationssystems (PCS), enhanced specialized mobile radios (ESMRs), and othertypes of wireless communications systems. More particularly, but notexclusively, the present invention relates to the use of prescribednetwork message sequences in initiating, or triggering, location-basedservice applications and re-use of existing radio interface parameterswithin such message sequences to provide low-accuracy location or toallow tuning of specialized receivers for high accuracy location for aparticular subscriber.

BACKGROUND

Early work relating to Wireless Location Systems is described in U.S.Pat. No. 5,327,144, Jul. 5, 1994, “Cellular Telephone Location System,”which discloses a system for locating cellular telephones using timedifference of arrival (TDOA) techniques. Further enhancements of thesystem disclosed in the '144 patent are disclosed in U.S. Pat. No.5,608,410, Mar. 4, 1997, “System for Locating a Source of BurstyTransmissions.” Both of these patents are assigned to TruePosition,Inc., the assignee of the present invention. TruePosition has continuedto develop significant enhancements to the original inventive concepts.

Over the past few years, the cellular industry has increased the numberof air interface protocols available for use by wireless telephones,increased the number of frequency bands in which wireless or mobiletelephones may operate, and expanded the number of terms that refer orrelate to mobile telephones to include “personal communicationsservices”, “wireless”, and others. The air interface protocols now usedin the wireless industry include AMPS, N-AMPS, TDMA, CDMA, GSM, TACS,ESMR, GPRS, EDGE, UMTS WCDMA, and others.

The viability and value of Wireless Location System technology has beenextensively demonstrated. In 2004 and 2005, TruePosition (the assigneeof the present invention) installed E-911 Wireless Location Systems inmore than 40,000 Base Transceiver Stations (BTS), providing emergencylocation coverage for wireless subscribers across the continental UnitedStates.

The wireless communications industry has acknowledged the value andimportance of the Wireless Location System. In June 1996, the FederalCommunications Commission issued requirements for the wirelesscommunications industry to deploy location systems for use in locatingwireless 9-1-1 callers. Widespread deployment of these systems canreduce emergency response time, save lives, and save enormous costsbecause of reduced use of emergency response resources. In addition,surveys and studies have concluded that various wireless applications,such as location sensitive billing, fleet management, and others, willhave great commercial value in the coming years.

As mentioned, the wireless communications industry uses numerous airinterface protocols in different frequency bands, both in the U.S. andinternationally. In general, neither the air interface nor the frequencybands impact the Wireless Location System's effectiveness at locatingwireless telephones.

All air interface protocols use two categories of channels, where achannel is defined as one of multiple transmission paths within a singlelink between points in a wireless network. A channel may be defined byfrequency, by bandwidth, by synchronized time slots, by encoding, shiftkeying, modulation scheme, or by any combination of these parameters.

The first category, called control or access channel, is used to conveyinformation about the wireless telephone or transmitter, for initiatingor terminating calls, or for transferring bursty data. For example, sometypes of short messaging services transfer data over the controlchannel. Different air interfaces use different terminology to describecontrol channels but the function of the control channels in each airinterface is similar.

The second category of channel, known as voice or traffic channel,typically conveys voice or data communications over the air interface.Traffic channels come into use once a call has been set up using thecontrol channels. Voice and user data channels typically use dedicatedresources, i.e., the channel can be used only by a single mobile device,whereas control channels use shared resources, i.e., the channel can beaccessed by multiple users. Voice channels generally do not carryidentifying information about the wireless telephone or transmitter inthe transmission. For some wireless location applications thisdistinction can make the use of control channels more cost effectivethan the use of voice channels, although for some applications locationon the voice channel can be preferable.

The following paragraphs discuss some of the differences in the airinterface protocols:

AMPS—This is the original air interface protocol used for cellularcommunications in the U.S. and described in TIA/EIA Standard IS 553A.The AMPS system assigns separate dedicated channels for use by controlchannels (RCC), which are defined according to frequency and bandwidthand are used for transmission from the BTS to the mobile phone A reversevoice channel (RVC), used for transmission from the mobile phone to theBTS, may occupy any channel that is not assigned to a control channel.

N-AMPS—This air interface is an expansion of the AMPS air interfaceprotocol, and is defined in EIA/TIA standard IS-88. It usessubstantially the same control channels as are used in AMPS butdifferent voice channels with different bandwidth and modulationschemes.

TDMA—This interface, also known as D-AMPS and defined in EIA/TIAstandard IS-136, is characterized by the use of both frequency and timeseparation. Digital Control Channels (DCCH) are transmitted in bursts inassigned timeslots that may occur anywhere in the frequency band.Digital Traffic Channels (DTC) may occupy the same frequency assignmentsas DCCH channels but not the same timeslot assignment in a givenfrequency assignment. In the cellular band, a carrier may use both theAMPS and TDMA protocols, as long as the frequency assignments for eachprotocol are kept separated.

CDMA—This air interface, defined by EIA/TIA standard IS-95A, ischaracterized by the use of both frequency and code separation. Becauseadjacent cell sites may use the same frequency sets, CDMA must operateunder very careful power control, producing a situation known to thoseskilled in the art as the near-far problem, makes it difficult for mostmethods of wireless location to achieve an accurate location (but seeU.S. Pat. No. 6,047,192, Apr. 4, 2000, Robust, Efficient, LocalizationSystem, for a solution to this problem). Control channels (known in CDMAas Access Channels) and Traffic Channels may share the same frequencyband but are separated by code.

GSM—This air interface, defined by the international standard GlobalSystem for Mobile Communications, is characterized by the use of bothfrequency and time separation. GSM distinguishes between physicalchannels (the timeslot) and logical channels (the information carried bythe physical channels). Several recurring timeslots on a carrierconstitute a physical channel, which are used by different logicalchannels to transfer information—both user data and signaling.

Control channels (CCH), which include broadcast control channels (BCCH),Common Control Channels (CCCH), and Dedicated Control Channels (DCCH),are transmitted in bursts in assigned timeslots for use by CCH. CCH maybe assigned anywhere in the frequency band. Traffic Channels (TCH) andCCH may occupy the same frequency assignments but not the same timeslotassignment in a given frequency assignment. CCH and TCH use the samemodulation scheme, known as GMSK. The GSM General Packet Radio Service(GPRS) and Enhanced Data rates for GSM Evolution (EDGE) systems reusethe GSM channel structure, but can use multiple modulation schemes anddata compression to provide higher data throughput. GSM, GPRS, and EDGEradio protocols are subsumed by the category known as GERAN or GSM EdgeRadio Access Network.

UMTS—Properly known as UTRAN (UMTS Terrestrial Radio Access Network), isan air interface defined by the international standard third GenerationPartnership program as a successor to the GERAN protocols. UMTS is alsosometimes known as WCDMA (or W-CDMA), which stands for Wideband CodeDivision Multiple Access. WCDMA is direct spread technology, which meansthat it will spread its transmissions over a wide, 5 MHz carrier.

The WCDMA FDD (Frequency Division Duplexed) UMTS air interface (theU-interface) separates physical channels by both frequency and code. TheWCDMA TDD (Time Division Duplexed) UMTS air interface separates physicalchannels by the use of frequency, time, and code.

All variants of the UMTS radio interface contain logical channels thatare mapped to transport channels, which are again mapped to W-CDMA FDDor TDD physical channels. Because adjacent cell sites may use the samefrequency sets, WCDMA also uses very careful power control to counterthe near-far problem common to all CDMA systems.

Control channels in UMTS are known as Access Channels whereas data orvoice channels are known as Traffic Channels. Access and TrafficChannels may share the same frequency band and modulation scheme but areseparated by code. Within this specification, a general reference tocontrol and access channels, or voice and data channels, shall refer toall types of control or voice and data channels, whatever the preferredterminology for a particular air interface. Moreover, given the manytypes of air interfaces (e.g., IS-95 CDMA, CDMA 2000, UMTS, and W-CDMA)used throughout the world, this specification does not exclude any airinterface from the inventive concepts described herein. Those skilled inthe art will recognize other interfaces used elsewhere are derivativesof or similar in class to those described above.

GSM networks present a number of potential problems to existing WirelessLocation Systems. First, wireless devices connected to a GSM/GPRS/UMTSnetwork rarely transmit when the traffic channels are in use. The use ofencryption on the traffic channel and the use of temporary nicknames(Temporary Mobile Station Identifiers (TMSI)) for security render radionetwork monitors of limited usefulness for triggering or taskingwireless location systems. Wireless devices connected to such aGSM/GPRS/UMTS radio network merely periodically “listen” for atransmission to the wireless device and do not transmit signals toregional receivers except during call setup, voice/data operation, andcall breakdown. This reduces the probability of detecting a wirelessdevice connected to a GSM network. It may be possible to overcome thislimitation by actively “pinging” all wireless devices in a region.However, this method places large stresses on the capacity of thewireless network. In addition, active pinging of wireless devices mayalert mobile device users to the use of the location system, which canreduce the effectiveness or increase the annoyance of a pollinglocation-based application.

SUMMARY

The following summary provides an overview of various aspects ofexemplary implementations of the invention. This summary is not intendedto provide an exhaustive description of all of the important aspects ofthe invention, or to define the scope of the invention. Rather, thissummary is intended to serve as an introduction to the followingdescription of illustrative embodiments.

Methods and systems in accordance with the present invention areemployed by a wireless location system (WLS) for locating a wirelessdevice operating in a geographic area served by a wirelesscommunications system. An exemplary method includes defining ageo-fenced area, and then monitoring a set of predefined signaling linksof the wireless communications system. The monitoring also includesdetecting that a mobile device has performed any of the following actswith respect to the geo-fenced area: (1) entered the geo-fenced area,(2) exited the geo-fenced area, and (3) come within a predefined degreeof proximity near the geo-fenced area. In addition, the method may alsoinclude, in response to detecting that the mobile device has performedat least one of said acts, triggering a high-accuracy location functionfor determining the geographic location of the mobile device.

By way of further example, in accordance with the present invention, aLink Monitoring System (LMS) maintains tables of Abis, A and GSM-MAPinterface traffic on a subscriber-by-subscriber basis. U.S. Pat. No.6,782,264 B2, Aug. 24, 2004, Monitoring of Call Information in aWireless Location System, discloses how an AMS, an early incarnation ofthe present LMS, can be used advantageously to initiate locationservices and schedule radio resources in a Wireless Location System. Inthe context of the present invention, this retained subscriberinformation can allow the location of wireless devices to be determinedwhile a subscriber is placing a call, on a call, or even idle. Theretained network information can allow for the location of subscribersin an area or in proximity to another specified mobile device. Inaccordance with the present invention, a series of triggers can be usedto effectively locate wireless devices, and this ability to locatewireless devices can be leveraged for possible security-relatedfunctions. The series of triggers can include a called-number trigger,MSISDN and IMSI triggering, idle mobile location trigger, list of allmobile devices recently in set of cells (CGI) triggering, backgroundlocation of all subscribers in set of cells (CGI) triggering, and smartproximity identification triggering. (Those skilled in the art willappreciate that a cell is the area given radio coverage by one basetransceiver station, or BTS, and that the standard GSM networkidentifies each cell via the cell global identity (CGI) number assignedto each cell. A location area (LA) is defined in GSM parlance as a groupof cells, and is the area in which the subscriber is paged. Each LA isserved by one or more base station controllers, or BSCs, and is assigneda location area identity (LAI) number.)

For example, a wireless device can be located based on the number calledby the wireless device. The system can be tasked with a dialled digittrigger at the Link Monitoring System (LMS) in accordance with an aspectof the present invention. (As described below, an LMS in accordance withthe present invention may be viewed as an enhanced version of an AbisMonitoring System.) Once the trigger is tasked, the system canautomatically locate any wireless device in the service area diallingthe specified “trigger” number. For example, when the specified“trigger” number is dialled by another wireless device, the WirelessLocation System can identify and locate the wireless device that calledthe specified “trigger” number. Further, existing AMS trigger/taskingtables support international dialling lengths, and therefore eveninternational numbers can be used as the “trigger” number. (U.S. Pat.No. 6,519,465 B2, Feb. 11, 2003, Modified Transmission Method forImproving Accuracy for E-911 Calls, describes that an E911 “trigger” maybe stored in a phone and employed to cause the phone to transmit aspecial signal when the user dials 911. The special signal assists theWLS in locating the phone.)

A system in accordance with the present invention may be configured tolocate a wireless device by its International Mobile Station Identity(IMSI). An IMSI or list of IMSIs can be loaded into the LMS. The LMS canscan the Abis and A messaging traffic until the IMSI-to-TMSI correlationcan be verified and retained. The IMSI-TMSI association is updated withchanges when the LMS notifies the Serving Mobile Location Center (SMLC).The discovered TMSI is then set as a trigger so that the mobile deviceof interest can be located at a later time.

The system may also be configured to locate idle mobile devices in anetwork by requesting the Gateway Mobile Location Center (GMLC) tosubmit Any Time Interrogation (ATI) queries to the HLR. Submission ofATI queries to the HLR can result in a call being placed to the wirelessdevice by the network, using supplementary services. The call placed tothe wireless device by the network can page and authenticate thewireless device without placing the wireless device on a traffic channelor otherwise notifying the subscriber of the call. During the paging andauthentication messaging, the system can use U-TDOA to process andaccurately determine the location of the wireless device. A loweraccuracy CGI+TA location is automatically generated by this transaction.Acting as a GSM Service Control Function (gsmSCF), the GMLC may use ATIto request information (e.g., subscriber state and location information)from the HLR at any time. The ATI procedure can be used to transitionthe MS from an idle state to an active signaling state which then can belocated with high-accuracy by the wireless location system.

Wireless devices may also be identified and located, as mentioned above,based on their presence in a defined geographic area. This “geo-fencing”feature can be accomplished by loading a location area, defined as a setof cells (CGIs), into the LMS. The LMS then develops a list of IMSIs,MSISDNs, and associated TMSIs that initiate a network transaction in thegeographic area of interest. A network transaction for this feature maybe defined as a call origination or termination, a SMS exchange, and alocation update (i.e., a GSM MAP “location” update for the purposes ofroaming as opposed to a U-TDOA location event).

Mobile devices can also be identified and located based on theirhistorical presence in a pre-defined geographic area. The backgroundlocation feature can allow an operator to define an area of interest,collect the IMSI/TMSI information for mobile devices that had a networktransaction in the area of interest, and locate the identified mobiledevices on later network transactions.

Mobile devices can also be identified and located on the basis ofproximity to another mobile device using Smart Proximity Identification.The Smart Proximity Identification feature can be used to allow anoperator to obtain a list of wireless devices operating in the same areaas a mobile device of interest. For example, a set of wireless devicesoperating in an area near a known wireless device of interest can belocated. The known wireless device can be located via its known mobileID. Subsequently, a complete list of mobile devices in the same area canbe determined. The mobile devices found in the same geographic area asthe mobile of interest can then be queried via Anytime Interrogation(ATI) and the supplementary services and the locations produced can beused to determine proximity to the mobile of interest.

Additional features and advantages of the invention will be madeapparent from the following detailed description of illustrativeembodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing summary, as well as the following detailed description, isbetter understood when read in conjunction with the appended drawings.For the purpose of illustrating the invention, there is shown in thedrawings exemplary constructions of the invention; however, theinvention is not limited to the specific methods and instrumentalitiesdisclosed. In the drawings:

FIG. 1 illustrates an exemplary architecture for a GERAN/UTRAN networkreference in accordance with the present invention;

FIG. 1A illustrates the CGI/CI location for omni cells in accordancewith the present invention;

FIG. 1B illustrates the CGI/CI location for sectored cells in accordancewith the present invention;

FIG. 1C illustrates the CGI+TA location for omni cells in accordancewith the present invention;

FIG. 1D illustrates the CGI+TA location for sectored cells in accordancethe present invention;

FIG. 1E illustrates Enhanced Cell ID (ECID) with grid mapping in asectored cell in accordance with the present invention;

FIG. 2 depicts an exemplary method for the MSC to obtain the IMEI of amobile station in accordance with the present invention;

FIG. 3A depicts an exemplary method for an LMS to determine the identityof a mobile station in accordance with the present invention;

FIG. 3B illustrates an exemplary method of the SMS origination triggerin accordance with the present invention;

FIG. 3C illustrates an exemplary method of the SMS termination triggerin accordance with the present invention;

FIG. 3D illustrates an exemplary method of the Mobile Originationtrigger in accordance with the present invention;

FIG. 3E illustrates an exemplary method of the Mobile Terminationtrigger in accordance with the present invention;

FIG. 4 depicts an exemplary method of dialed digit triggering inaccordance with the present invention;

FIG. 5A depicts an exemplary method of MSID triggering in accordancewith the present invention;

FIG. 5B depicts an exemplary method of using AnyTimeInterrogation (ATI)in accordance with the present invention;

FIG. 5C depicts an exemplary method of using SMS ping in accordance withthe present invention;

FIG. 6 depicts an exemplary method of using historical cell location inaccordance with the present invention;

FIG. 7 depicts an exemplary method of using Cell ID triggers inaccordance with the present invention;

FIG. 8A depicts an exemplary method for detection of mobile devicesbased on location and time in accordance with the present invention;

FIGS. 8B, 8C, and 8D illustrate an exemplary method of Smart ProximityLocation in accordance with the present invention;

FIG. 8E illustrates a the Location Area Identity code in accordance withthe present invention;

FIG. 8F is a flowchart of an exemplary process for detecting an idlemobile with a static Location Area Code (LAC) in accordance with thepresent invention;

FIG. 8G is a flowchart of an exemplary process for detecting a mobileduring handover in accordance with the present invention;

FIG. 8H illustrates how a geo-fenced area may comprise an area whoseperimeter is defined by the joint coverage areas of a plurality of BTSand/or LMU antennae sectors;

FIG. 8I is a flowchart of an exemplary process for detecting a mobileusing proximity detection in accordance with the present invention;

FIG. 8J is a flowchart of an exemplary process for dynamically detectinga mobile using geo-fencing in accordance with the present invention;

FIGS. 8K, 8L, 8M, 8N, 8O and 8P illustrate exemplary cell configurationsin accordance with the present invention; and

FIG. 9 is a flowchart of an exemplary process for detecting a mobileusing calling number triggering in accordance with the presentinvention.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

We will now provide a detailed description of illustrative embodimentsof the present invention. This detailed description is generallyorganized as follows: Section A provides an overview of an entire systememploying a Links Monitoring System, or LMS, and Radio Network Monitor,or RNM, together with so-called advanced triggers for initiatinglocation services applications. Section B discusses radio transactions,network events and filters, and applications thereof in the context ofthe inventive system. Section C discusses network triggers and events,and Section D describes the inventive advanced triggers in greaterdetail. Section D includes a subsection D.8., entitled Smart ProximityLocation, which includes a detailed discussion of the geo-fencing aspectof the present invention. The discussion of geo-fencing is primarily setforth in Section D.8.A, and makes reference to FIGS. 8F-8P. Finally,Section E provides a conclusion, including a discussion of some of theterminology contained herein.

A. Overview

The inventive system described herein may be viewed as a substantialextension of the system described in U.S. application No.US2004000768587, and its parent, U.S. Pat. No. 6,782,264 (Anderson). Forexample, while the '264 patent describes a system that monitorscommunications between a base transceiver station and base stationcontroller, and forwards mobile station (MS) information to a WirelessLocation System for emergency call location, the advanced location-basedservices applications described herein utilize additional networkmessages as triggering events and information sources for a wide varietyof location-based services.

It should be noted that many of the acronyms and abbreviations usedherein are taken from Technical Report GSM 01.04 V8.0.0 (2000-05),Digital cellular telecommunications system (Phase 2+); version 8.0.0(Release 1999); Abbreviations and acronyms. The terminology andnomenclature used to describe this invention are intended to benon-limiting and are based on the GSM definitions published by the GSMAssociation in “Terms & Acronyms”. This publication is available athttp://www.gsmworld.com/technology/glossary.shtml. However, althoughGSM-centric terms are used, the concepts embodied in the describedherein apply to other wireless radio communications networks.

In Universal Mobile Telecommunications System (UMTS), the plannedsuccessor to GSM, the wideband Code Division Multiple Access (W-CDMA)radio interface will benefit from use of wideband RNM receivers forpassive radio monitoring. Wideband LMUs may be used for high-accuracyU-TDOA and AoA location. Changes to the interface and interoperabilitystandards by the Third Generation Partnership Program (3GPP) mean thatsome of the acronyms and naming conventions change, but the operationsperformed in the radio control network and intelligent services networkremain substantively the same. Thus, in this specification, these itemscan be viewed as equivalents:

GSM/GPRS/GSM-R UMTS Cell Global Identifier (CGI) Cell ID (CI) TimingAdvance (TA) ½ Round-Trip-Time (RTT) Abis Interface Iub Interface AInterface Iu-CS (Circuit Switched) or Iu-PS (Packet

Switched) Abis Monitor (LMS) Iub Monitor (IMS) Base transceiver station(BTS) Node-B Base station Controller (BSC) Radio Network Controller(RNC) Mobile Station (MS) User Equipment (UE) Subscriber InformationModule (SIM) User Service Identity Module (USIM)

FIG. 1 shows the architecture of an illustrative GERAN/UTRAN networkreference model 10 with a Radio Network Monitor (RNM) 82 and a LinkMonitoring System (LMS) 11. The RNM 82 is effectively a bank ofnarrowband receivers tunable to both the uplink and downlink channelsanywhere in the frequency band. The RNM has been implemented on theradio receiver platform previously described in U.S. Pat. No. 6,782,264as the alternative narrowband embodiment of the receiver module for theSCS. The LMS may be implemented as an enhanced version of the Abismonitor described in U.S. Pat. No. 6,782,264, modified so as to be ableto monitor not only the Abis and A interfaces, but also the GSM-MAP,Iub, Iu-PS and Iu-CS interfaces. The LMS can be implemented, withmodifications, on the same hardware/software chassis as the Abis Monitor(e.g., a set of custom applications with Agilent Access7 softwareapplication running on a cluster of Intel TSEMT2 or TSRLT2 UNIXservers).

The network 10 further includes a Serving Mobile Location Center (SMLC)12. The RNM 82 is the primary component that can be deployed at acarrier's cell sites. The RNM 82 is preferably implemented as adistributed network of radio receivers capable of receiving RACH andSDCCH messages for autonomous generation of location services. The RNM82 tunes to directed frequencies to gather data for the system. The RNM82 can then forward the collected data to the SMLC 12. All RNMs 82 in anetwork are preferably time- and frequency-synchronized through the useof the Global Positioning Satellite (GPS) constellation (not shown).

The SMLC 12 is preferably a high volume location-processing platform.The SMLC 12 contains U-TDOA and multipath mitigation algorithms forcomputing location, confidence interval, speed, and direction of travel.The SMLC 12 can also determine which wireless phones to locate basedupon triggering from the Link Monitoring System (LMS) 11 or requestsfrom the L_(b) interface 54 to an infrastructure vendor's Base StationController (BSC) 96 (or MSC 50 in some cases). The SMLC 12 is typicallyco-located at the operator's BSC 96 but can also be remotelydistributed. The primary functions of the SMLC 12 are to receive reportson signal detection from the RNMs 82, to perform location processing,and to calculate the location estimate for each signal. The SMLC 12manages the network and provides carrier access to location records. TheSMLC 12 is responsible for the collection and distribution of locationrecords. The SMLC 12 also maintains configuration information andsupports network management.

The LMS 11 continuously monitors all Abis signaling links 76 (and insome cases A-interface links 52 and GSM Mobile Application Protocol(GSM-MAP) 48 interface) in a network 10 to which the LMS 11 isconnected. The function of the LMS 11 is to capture messages in the call(e.g., a GSM voice conversation or a GPRS data session) and SMS setupprocedure, mid-call control messages, and call termination and releasemessages for MSs 80. The LMS 11 then forwards the data contained inthose messages to the SMLC 12 for subsequent location processing.

The GSM service control function (gsmSCF) 20, also called a servicecontrol point (SCP), contains database and logical rules for providingnon-call oriented services to a subscriber. The GSM Mobile ApplicationProtocol (GSM-MAP) 48 is the communications medium for call-relatedcontrol services on the wired part of a wireless network. The GSM-MAP 48exists to provide services like automatic roaming, authentication,location services intersystem hand-off, and short message servicerouting on a GSM or UMTS network. All wireless network elements such asthe MSC 50, HLR 34, VLR (in the MSC 50), GMSC 44, EIR 32, GMLC 98, andgsmSCF 20 use this messaging protocol to communicate among each other.The GSM-MAP 48 resides on the international Signaling System 7 network(SS7).

The Gateway Mobile Location Center (GMLC) 98 is defined by 3GPPstandards as the clearinghouse for location records in a GSM/GPRS/UMTSnetwork. The GMLC 98 serves as a buffer between the tightly controlledSS7 network (the GSM-MAP network) 48 and the public internet.Authentication, access control, accounting, and authorization functionsfor location-based services are commonly resident on or controlled bythe GMLC 98.

The Le interface 24 is an IP-based XML interface originally developed bythe Location Interoperability Forum (LIF) and then later standardized bythe 3rd Generation Partnership Program (3GPP) for GSM (GERAN) and UMTS(UTRAN). The Location-based services (LBS) client 22 is also known as aLCS (Location Services). The LBS and LCS 22 are software applicationsand services uniquely enabled to use the location of a mobile device.

The E5+ interface 18 is a modification of the E5 interface defined inthe Joint ANSI/ETSI Standard 036 for North American E9-1-1. The E5+interface 18 connects the SMLC 12 and GMLC 98 nodes directly allowingfor push operations when LMS 11 or RNM 82 triggers are used by thewireless location system with either network acquired information(cell-ID, NMR, TA, etc) or via TDOA and/or AoA (angle of arrival)performed by specialized receivers.

User equipment (UE) 88 can be defined as equipment such as a UMTS mobiledevice. NodeB 86 is the Universal Mobile Telephony System Radio AccessNetwork (UTRAN) network interface to the UMTS radio interface. The RadioNetwork Controller (RNC) 70 enables autonomous radio resource management(RRM) by UTRAN. The RNC 70 performs the same functions as the GSM BSC,providing central control for the RNS elements (RNC and Node Bs). TheRNC 70 handles protocol exchanges between Iu, Iur, and Iub interfacesand is responsible for centralized operation and maintenance of theentire radio network system.

The Serving GPRS Support Node (SGSN) 68 monitors the location ofindividual GPRS capable Mobile Stations 80 and performs basic securityfunctions and access control functions. The SGSN 68 can serve both theGlobal System for Mobility (GSM) radio access network (GERAN) and UMTSradio networks.

The Gateway GPRS Support Node (GGSN) 46 acts as a system routing gatewayfor the GPRS network. The GGSN 46 is a connection to external packetdata networks (e.g., public internet) and performs the task of billing,routing, security firewalling, and access filtering. The Gateway MSC(GMSC) 44 acts as a bridge for roaming subscribers to visited MSCs inother operator's networks. Both control signaling and traffic trunks aresetup via the GMSC 44.

The Um 15 is the GSM radio interface. The Uu 17 is the UMTS radiointerface. The Iub interface 90 is located on a UMTS network and isfound between the RNC (Radio Network Controller) 70 and the NodeB 86.The Iupc 72 interconnects the UMTS RNC 70 with the SMLC (also called theSAS) in the UMTS network for location estimation generation. The Iu-CS(Circuit Switched) interface 62 connects the UMTS RNC 70 with thecircuit switched communications oriented network (the MSC) 50. The Iu-PS(Packet Switched) interface 74 connects the UMTS RNC 70 with the packetswitched communications oriented network (SGSN) 68. The Gb interface 66interconnects the BSC 96 with the SGSN 68 allowing for routing of GPRScommunications.

The Gn interface 60 is a GPRS packet interface which is located betweenthe SGSN 68 and GGSN 46. The Gs interface 64 is a GPRS system interfacelocated between the SGSN 68 and the MSC 50. The Gr interface is aGSM-MAP interface which is located between the SGSN 68 and the HomeLocation Register (HLR) 34.

As described in U.S. Pat. No. 6,782,264, it is possible to monitor thebase transceiver station (BTS) to base station controller (BSC) link(e.g., the Abis link) for triggering messages and information fields. Apassive network monitor, called the AMS (Abis Monitoring System) in the'264 patent and exemplified by monitoring the GSM Abis interface, hasbeen extended in accordance with the present invention and is now calledthe Link Monitoring System, or LMS. The Link Monitoring System (LMS) canmonitor multiple cellular network data links simultaneously, scanningfor data of interest, and can detect particular messages or data fieldswithin messages. Setting or tasking of messages or data fields ofinterest can take place at any time. When a match occurs, the LMS may befurther triggered to perform a pre-set action, such as a write tostorage memory or forwarding of the triggering message and (or) datafields to another system node.

The Radio Network Monitor extends the concept of passive monitoring forlocation triggering information and messaging to the radio airinterface. The RNM can detect and monitor both uplink (mobile device toBTS or NodeB) and downlink radio communications.

The illustrative system employs information from both the wirelessnetwork and the wired (or landline) network. In advance of national orinternational standardization efforts for location-based services insuch organizations as 3GPP, ETSI and ANSI, the LMS has been developed toassist in acquiring the certain radio, call and caller information forthe immediate deployment of location-based services. All attributes andabilities of the LMS can be incorporated into other nodes of thewireless and wired communications networks. This approach is applicableto all digital cellular and like wireless networks, including but notlimited to TDMA, CDMA, and OFDM-based wireless networks. (OFDM standsfor Orthogonal Frequency Division Modulation, a spread spectrum methodused for carrier modulation in digital transmissions). The GSM system isused to describe the inventive concepts underlying the presentinvention, but the differing naming systems and acronym conventions useddoes not preclude application of the invention to the GPRS and UMTSsystem.

The Link Monitoring System allows for passive, non-intrusive monitoringof, for example, the GSM, GSM-R, GPRS, and UTMS systems. In theexemplary case of a GSM system, the LMS can passively receive datastreams from the Abis (BTS-BSC) interface, the A (BSC-MSC) interface,and the GSM MAP interface (MSC-HLR, MSC-GMLC, MSC-GMSC and MSC-gsmSCF).The term GSM MAP (where MAP stands for Mobile Application Part) is usedto refer to the global SS7 network and includes the C, D, E, F, H, Gc,Gf, Gr, Lh, and Lg interfaces.

In the exemplary case of a GPRS system, the LMS can passively receivedata streams from the Abis (BTS-BSC or BTS-PCU) interface, the Gb(PCU-SGSN) interface, and the GSM MAP interface (SGSN-HLR, SGSN-GMLC andSGSN-gsmSCF). In the exemplary case of a UMTS system, the LMS canpassively receive data streams from the Iub (Node B-RNC) interface, theIu-CS (RNC-MSC) interface, the Iu-PS (RNC-SGSN) interface, and the GSMMAP interface (MSC-HLR, MSC-GMLC and MSC-gsmSCF, SGSN-HLR, SGSN-GMLC andSGSN-gsmSCF).

The LMS can search received data for particular messages or data fieldswithin messages. Setting or tasking of messages or data fields ofinterest can take place at any time. When a match occurs, the LMS isfurther triggered to perform a pre-set action, normally a write tostorage memory or forwarding of the triggering message and (or) datafields to another system node.

Once the LMS has been triggered, a variety of information may beobtained from the triggering message or subsequent data messaging.Information gleaned from this method can include event-relatedinformation, mobile or subscriber account information,conversation-related information, serving cell information, and radioenvironment information.

Event-related information can include the triggering event, accumulatedradio interface and cellular system data, subscriber data, the monitoreddata link where the triggering data was received as well as internallydeveloped LMS timestamp and indexing information. Mobile or subscriberaccount information can include information available from the handsetover the radio interface and from the carrier HLR. Both the IMEI fromthe handset and the IMSI from the SIM could be acquired, as well as thecalling or called MS-ISDN, dependent on the links monitored and themessages scanned. Conversation-related information can include thecalling number and the called number for both the mobile originating andmobile terminating cases. These numbers are sometimes also called theSMS PINS, but would still be included in the conversation-relatedinformation.

Serving cell information can include the Cell ID (CGI for GERAN networksor CI for UMTS networks), the Timing Advance (TA in GSM/GPRS) orRound-Trip-Time (RTT in UMTS), the Radio Frequency (Absolute RadioFrequency Channel Number (ARFCN)), the Base Station Identity Code(BSIC), the Terminal Endpoint Identifier (TEI), and Location Area Code(LAC). Prior Cell information is available during a handover event andincludes the same data set as the current serving cell.

Radio-related information gathered by the system can include the uplink(MS to BTS, or UE to Node-B) and the downlink (BTS to MS or Node-B toUE) power and quality levels, and the Beacon or Broadcast ControlChannel (BCCH) ARFCN, power, and quality. The Network Measurement Report(NMR) with channel and power levels to potential handoff candidatessectors or cells can also be collected when available.

We will now describe the use of radio transactions, network events, andfilters in accordance with various aspects of the present invention.

B. Radio Transactions, Network Events and Filters

The network monitor allows the wireless location system to passivelymonitor the traffic between the mobile phone and the BTS on both theuplink and downlink. The Radio Network Monitor (RNM) 82, a widebandreceiver or bank of narrowband receivers located within the area ofinterest, scans and discovers, or is pre-set with frequency, timeslot,codes and/or hopping sequence, to monitor the Random Access Channels(RACH), Access Grant Channels (AGCH) and control channels (SDCCH inGSM/GPRS) for messages of interest. Since the RNM 82 has no capabilityto decrypt encrypted information the message transactions of interestwill be restricted to: (1) call originations, (2) call terminations, (3)short message service (SMS) originations, (4) SMS terminations, and (5)location update requests.

Wireless devices can be located without physical connection to thewireless carrier's infrastructure through the use of the RNM 82 byreceiving the Access Grant Channels (AGCH) on the downlink transmissionsfrom the BTS and accessing the messaging information contained thereinwhich includes the timing advance (TA), channel reference number andframe number. This information is obtained by detecting, demodulatingand decoding the unencrypted AGCHs from the BTS's downlinktransmissions. This is used as a network-autonomous trigger for thewireless location system enabling it to locate the wireless device withUTDOA by receiving subsequent uplink transmissions from the mobiledevices on SDCCH. The wireless device's location can also be estimated,albeit with much less accuracy than UTDOA or AoA, with CGI+TA. TheCGI+TA can be improved with other information from the AGCH as well asother a priori information about the wireless network. Demodulating anddecoding the initial SDCCH transmissions from the mobile device willprovide identifying information about the mobile device, specificallythe TMSI or IMSI. If ciphering is not enabled in the wireless networkfurther demodulation and decoding of SDCCH transmissions from thewireless device will provide other identifying information such as IMEI,MSISDN as well as calling number or called number.

C. Network Triggers and Events

The LMS 11 may be set to trigger on call connection events or radiointerface events. These events may comprise a single message or a seriesof messages, each related to the call connection or radio event. Theseevents include: (1) Network Measurement Report Received, (2) MobileOriginated Call Placed, (3) Mobile Terminated Call Received, (4) MobileOriginated SMS Sent, (5) Mobile Terminated SMS Received, (6) Handover(Begins), (7) Handover (Completed), (8) Location Update, (9) RF ChannelAssignment, (10) IMSI Attach, (11) IMSI Detach, (12) Mobile OriginatedCall Disconnect (13) Mobile Terminated Call Disconnect, and (14)Identify Equipment Response (15) Call Failure.

The inventive system described herein uses more than the call setupmessaging transactions previously described in U.S. Pat. No. 6,782,264(Anderson). In addition to the call setup information employed forlocation system triggering and tasking, advanced location-based servicestriggering applications may utilize additional radio interface, Abis, A,and GSM-MAP interface messages transactions and data. The term“transaction” refers to a message or message sequence potentially usefulto the advanced trigger invention. The term “filter” refers to pre-setrules in the LMS for analysis of the monitored data within thetransaction. Filters can include MS identification, cell identification,location area codes, or differences between the monitored and expectedpre-set information.

The following procedures are used for location triggering by the RadioNetwork Monitor (RNM) and/or Link Monitoring System (LMS). A trigger forwireless location consists of a transaction and a filter. If atransaction occurs and the filtering matches, then a location trigger isgenerated. Each procedure contains the messaging needed fordetermination if a potential location-triggering event has occurred. Thedescription of each message includes the fields for filtering by thepreset rules for positive determination of the occurrence of a locationtrigger.

In the interest of brevity, descriptions of some common call messagesequences are grouped as procedures.

Initial Channel Assignment Procedure

The initial channel assignment procedure described below is common to(1) mobile originated calls, (2) SMS originations, and (3) locationupdates. In the initial channel assignment procedure, no messaging isencrypted over the radio interface and therefore all Mobile to BTS andMobile to BSC communications are available to the RNM as well as to theLMS.

The mobile device sends a CHANNEL REQUEST [3GPP 44.018, 9.1.8] to theBTS over the is sent to the BSC via the Random Access Channel (RACH) andthe BTS then sends a CHANNEL REQUIRED message [3GPP TS 48.058, 8.5.3] tothe BSC. The BSC will first respond with a CHANNEL ACTIVATION [3GPP TS48.058, 8.4.1] message to the BTS. The BTS (if sufficient radioresources are available) will respond to the BSC with a CHANNELACTIVATION ACKNOWLEDGE message [3GPP TS 48.058, 8.4.2]. This messagepair is linked via the contained Channel Number.

Once the BSC has confirm the reservation of the channel for the Mobiledevice, the BSC will order the Mobile via the BTS with a IMMEDIATEASSIGNMENT COMMAND message [3GPP TS 48.058, 8.5.6] message on thedownlink CCCH (the Access Grant Channel (AGCH).

The IMMEDIATE ASSIGNMENT COMMAND consists of one of three possible RadioResource (RR) assignment commands in the “Full Imm Assign Info” element.The relevant immediate assignment message is as defined in 3GPP TS 04.08(IMMEDIATE ASSIGNMENT [3GPP TS 24.008, 9.1.18], or IMMEDIATE ASSIGNMENTEXTENDED [3GPP TS 24.008, 9.1.19] or IMMEDIATE ASSIGNMENT REJECT [3GPPTS 24.008, 9.1.20]) with the “Page Mode” element set to the value “nochange”.

The IMMEDIATE ASSIGNMENT COMMAND are all associated to the originalCHANNEL REQUIRED message on the Abis link via the Request Referenceparameter [3GPP TS 48.058, 9.3.19 and 3GPP TS 44.018, 10.5.2.30]. ThisRequest Reference parameter identifies the both access request andaccess reason.

By linking the Establishment Cause Value [3GPP TS 44.018, Table9.1.8.1]9.1.8] of the original CHANNEL REQUEST and CHANNEL REQUIREDmessages with the Channel Number carried in the IMMEDIATE ASSIGNMENTCOMMAND, the RNM or LMS can follow the ongoing call origination, SMSorigination, or location update to the S-DCCH where mobile andsubscriber identification will become available.

The RNM and LMS will collect the cause value and the S-DCCH assignment,storing both in local memory. If the cause value is part of a locationtrigger for call origination, SMS origination, or location update event,the RNM or LMS may inform the wireless location system of the event forscheduling, initialization of a new historical call record, updating ofan existing call record or the keeping of statistics on such networkaccess events. The RNM and LMS will also collect originating cell siteinformation such as cell ID or CGI.

1. Location Update

In order for the MS to make mobile-terminated calls, the wirelessnetwork should know the location of the MS, regardless of its movement.Thus, the MS periodically reports its location to the network using theLocation Update procedure. The Location Update procedure is performedwhen: (1) the MS has been switched off and wants to become active; (2)the MS is active but not involved in a call, and it moves from onelocation area to another; or (3) after a regular predetermined timeinterval. During a Location Update procedure and the processing of amobile call, certain numbers are used including the Mobile Station ISDNNumber (MSISDN), the Mobile Subscriber Roaming Number (MSRN), theInternational Mobile Subscriber Identity (IMSI), the Temporary MobileSubscriber Identity (TMSI), and the Local Mobile Station Identity (LMSI)described above.

The Mobile Station ISDN Number (MSISDN) is the directory numberallocated to the mobile subscriber. The MSISDN is dialed to make atelephone call to the mobile subscriber. The number consists of CountryCode (CC) of the country in which the mobile station is registered (forexample, Germany is 49, and Brunei is 673), followed by a nationalmobile number which consists of Network Destination Code (NDC) andSubscriber Number (SN). A Network Destination Code is allocated to eachGSM PLMN (where PLMN refers to Public Land Mobile Network). Thecomposition of the MSISDN is such that it can be used as a global titleaddress in the Signaling Connection Control Part (SCCP) for routingmessages to the HLR of the mobile subscriber.

The Mobile Station Roaming Number (MSRN) is the number required by thegateway MSC to route an incoming call to a MS that is not currentlyunder the gateway's control. Using the MSISDN, a mobile-terminated callis routed to the gateway MSC. Based on this MSISDN, the gateway MSC canrequest for a MSRN to route the call to the current visited MSC.

The International Mobile Subscriber Identity (IMSI) is embodied in theSIM of the mobile equipment. The MS provides the IMSI any time the MSaccesses the network. The IMSI code has three components including theMobile Country Code (MCC), which has the same meaning and format as inthe LAI, Mobile Network Code (MNC), which also has the same meaning andformat as in the LAI, and the Mobile Subscriber Identification Number(MSIN), which is the code that identifies the mobile subscriber within aGSM PLMN. The overall number of digits in an IMSI code does not exceed15.

The Temporary Mobile Subscriber Identity (TMSI) is an identity aliasthat is used instead of the IMSI when possible. The use of a TMSIensures that the true identity of the mobile subscriber remainsconfidential by eliminating the need to transfer an IMSI code encipheredover a radio link. A Visitor Location Registry (VLR) allocates a uniqueTMSI code to each mobile subscriber that is operating in its area. Thiscode, which is valid only within the area supervised by the VLR, is usedto identify the subscriber in messages to and from the MS. When a changeof location area also involves a change of VLR area, a new TMSI code isallocated and communicated to the MS. The MS stores the TMSI on its SIM.

The Local Mobile Station Identity (LMSI) is temporary subscriber data.Use of the LMSI is, however, optional. In order to speed up the searchfor subscriber data in the VLR, a supplementary Local Mobile StationIdentity (LMSI) can be defined. The LMSI is allocated by the VLR atlocation updating and is sent to the Home Location Resister (HLR)together with the IMSI. The HLR makes no use of the LMSI, but includesit together with the IMSI in all messages sent to the VLR concerningthat MS.

When the GSM or UMTS mobile station (i.e., wireless device) detects achange in the Location Area Index (LAI) carried by the serving cellsBCCH, a location update procedure can be invoked. A GSM or UMTS mobiledevice can perform a Location Area Update (LAU) when in the Idle state.The LAU can be triggered when the mobile crosses a LA (Location Area)boundary, or periodically (The periodicity being set by the carriernetwork). A LAU can also be performed when the mobile is powered on. Ifthe change in LAI occurs mid-call (either due to carrier changes to theLAC or from movement of the Mobile), the mobile station can perform theLocation Update procedure once the call has completed and the mobile hasreturned to idle state.

Similarly a GPRS mobile device can perform a Routing Area Update in theReady and Standby state. The RAU can be triggered when the mobilecrosses a RA (Routing Area) boundary, or periodically (The periodicitybeing set by the carrier network). A RAU can also be performed when themobile moves from the Idle to the Standby state as will typically happenwhen the mobile is powered on. Execution of a RAU caused by crossing aLAC boundary can be accompanied by a LAU for mobile devices with bothpacket data (GPRS) and voice capability (GSM/UMTS).

The Location Update procedure uses the initial channel assignmentprocedure described above with the CHANNEL REQUIRED message's causevalue [3GPP TS 24.008, 9.1.8] bit sequence set for “Location Updating”

Once assigned to an S-DCCH, the mobile device sends the MobilityManagement (MM) message LOCATION UPDATE REQUEST [3GPP TS 24.008, 9.2.15]to the BTS which echoes back the LOCATION UPDATE REQUEST. The BTS thenpasses the LOCATION UPDATE REQUEST to the BSC. The LOCATION UPDATEREQUEST will contain either the mobile devices static InternationalMobile Station Identifier (IMSI) [3GPP TS 23.003, 2.2] or the locallyassigned Temporary Mobile Station Identifier (TMSI) [3GPP TS 23.003,2.4] depending on the registration status of the mobile. A newlypowered-on mobile the Location Area will initiate the LOCATION UPDATEREQUEST with the IMSI, while those mobile devices already registeredwith the network or one just entering the LA will used the TMSI foridentification during the LOCATION UPDATE REQUEST.

The network will then authenticate the mobile device, set ciphering,could check the IMEI of the mobile device via the Identity Requestprocedure, could set a new TMSI via the TMSI reallocation procedure,complete the location update procedure, and then use the Releaseprocedure to free up the reserved S-DCCH channel for other uses.

The completion of the successful Location Update procedure requires thatthe LOCATION UPDATING ACCEPT [3GPP 24.008, 9.2.13] be sent by the MSCvia the BSC and BTS to the mobile. The LMS may collect the mobile'scurrent location area identification (LAI) [3GPP TS 24.008, 10.5.1.3] atthis time.

During the location update procedure, the RNM or LMS can collect theTMSI to IMSI association for the newly register mobile, collect the TMSIassociated to both the collected location areas and collected servingcells (current and prior), and can trigger the wireless location systemto perform either a low accuracy (Cell-ID and Cell-ID with timingadvance are both available) or high accuracy (U-TDOA and/or AoA based)location estimate while the mobile is on the S-DCCH.

A high accuracy location usually involves using TDOA or AoA for a moreaccurate location of a wireless device, than is available via cell IDtechniques. The high accuracy location is more accurate than cell-basedlocation techniques and is typically better than 250 meters in accuracy.In the United States, high accuracy has been defined by the FederalCommunications Commission (FCC) in the E9-1-1 phase II mandate as 100meters or less 67% of the time and less than 300 meters 95% of the time.In contrast, a low accuracy location uses cell-ID based locationtechniques such as CGI/CI, CGI/CI with TA/RTT, and Enhanced Cell ID(ECID). These low accuracy location techniques have highly variablenon-uniform location accuracies that are not as accurate as the highaccuracy techniques discussed above.

The ECID technique relies on the mobile devices ability to record thepower levels (RXLev) of multiple potential handover candidate/neighborcells. This technique adds a power-difference-of-arrival (PDOA)measurement, derived from the existing GSM Network Measurement Report(NMR), in an attempt to improve a CGI+TA-based location estimate.

The PDOA value is based on the received signal levels (RXLEV) collectedby the mobile for the serving cell and at least three neighboring cells.Since the PDOA data collection requires visibility to three or moreneighbor cell sites, yield will be less than 100%. The affects of RFmultipath, mobile receiver quality, and granularity of the 7-bit RxLEVmeasurement act to reduce location accuracy.

Since ECID uses PDOA multi-lateration, the geographic layout of theneighbor cells also affects the quality of the location throughgeographic dilution of precision. The limitation of only 6 neighbor cellRxLEV measurements present in the NMR limits accuracy by limitingpotential GDOP reduction though site selection.

Since the PDOA measurement requires averaging over multiple samples (NMRis sent every 480 ms during an active call), latency is much higher thenfor other cell-ID based techniques.

FIGS. 1 a and 1 b illustrate the CG/CI location for omni and sectoredcells respectively. FIGS. 1 c and 1 d illustrate the CGI+TA (omni) andCGI+TA (sectored) location processes FIG. 1 e illustrates Enhanced CellID (ECID) with grid mapping in a sectored cell. FIGS. 1 a-1 e are shownin accordance with the present invention and are as used in wirelesstelecommunications industry conventions and standards.

The location update is detectable over the GSM, GPRS, or UMTS airinterface using the SDCCH Radio Network Monitor (RNM) 82. The LocationUpdate is also detectable over the Abis interface as a Location UpdateRequest mobility management message. The Location Update event willtrigger the LMS 11 to collect additional information for both lowaccuracy locations (CGI, CGI+TA, and CGI+TA+NMR) and radio frequencyinformation for tasking Location Measuring Units (LMUs) 92 emplaced inthe carrier local area for high accuracy TDOA or AoA location.

2. Routing Update

A GPRS mobile device will perform a Routing Area Update (RAU) in theReady and Standby state. The RAU is triggered when the mobile crosses aRouting Area (RA) boundary, or periodically, the periodicity set by thecarrier network. A RAU is also performed when the mobile moves from theIdle to the Standby state. This will typically happen when the mobile ispowered on.

3. Handover

A typical handover occurs between traffic channels mid-session when awireless phone is handed from one cell or sector to the next in order tomaintain a radio connection with the network. Handovers between controlchannels are also possible. The variables that dictate a handover dependon the type of cellular system. In CDMA based systems, interferencerequirements are the limiting factor for handover. In FDMA and TDMAsystems such as GSM the main limiting factor is the signal qualityavailable to the Mobile Station (MS). Other factors include: distancefrom the antenna (Timing Advance in GSM, Round Trip Time in UMTS); localload; and received signal strength or path loss levels.

Handover messaging takes place on the Fast Associated Control Channel(FACCH). The Fast Associated Control Channel appears in place of thetraffic channel when lengthy signaling is required between a GSM mobileand the network while the mobile is in call. The GSM Handover isdetectable over the Abis interface as a Handover Command RR BSSMAPmessage. The Handover Command cannot be normally detected by the RNM 82unless encryption key sharing is enabled.

The handover procedure starts with the HANDOVER COMMAND [3GPP TS 44.018,9.1.15] issued by the BSC to the BTS. The HANDOVER COMMAND contains thecurrent Cell ID [3GPP 23.003, 4.3.1], the current TCH [3GPP TS 44.018,10.5.2.5] and future TCH [3GPP TS 44.018, 10.5.2.5a], the Timing Advance[3GPP TS 44.018, 10.5.2.40] and the Handover Reference [3GPP TS 44.018,10.5.2.15].

The handover procedure completes with the HANDOVER COMPLETE [3GPP TS44.018, 9.1.16] message between the BTS and BSC. This message exists toconfirm the handover was successful. The LMS can use this message forthe same purpose.

The LMS can collect all the information fields available in the listedmessages for local storage, location triggering and for following theTCH reassignment for the current call. The LMS may forward the collectedinformation and accumulated call record to the WLS for a low-accuracylocation based on the newly collected cell-ID and timing advance data.The LMS may forward the collected information and accumulated callrecord to the WLS for a high accuracy U-TDOA or AoA location on thenewly assigned Traffic Channel.

4. Call Release

Call Release refers to the end-of-call or end-of-data session whenchannel resources currently reserved for use are freed for reuse andreassignment. An established call session can be terminated by thecalling party, the called party, or by radio interference and signalloss.

Release [3GPP TS 24.008, 9.3.18] message contents vary dependent on therelease initiation party. RELEASE for the network to mobile stationdirection is detailed in 3GPP TS 24.008, 9.3.18.1. RELEASE for themobile station to network direction is detailed in 3GPP TS 24.008,9.3.18.2. RELEASE for signal loss is the same as for the network tomobile station direction.

For the network to mobile station direction, the RELEASE message is sentto indicate that the network intends to release the transactionidentifier, and that the receiving equipment shall release thetransaction identifier after sending RELEASE COMPLETE [3GPP TS 24.0089.3.19.1] specific to the network to mobile station direction.

For the mobile to network direction, the RELEASE message is sent fromthe mobile station to the network to indicate that the mobile stationintends to release the transaction identifier, and that the receivingequipment shall release the transaction identifier after sending RELEASECOMPLETE [3GPP TS 24.008, 9.3.19.2]

The LMS monitors for the RELEASE and RELEASE COMPLETE messages todetermine the end of the monitored call session and for completing thehistorical, accumulated call record. The LMS may also store the releaseCause [3GPP TS 24.008, 10.5.4.11] if available for later analysis.

The LMS may forward the RELEASE message event to the wireless locationsystem with the total accumulated call record. The WLS may generate afinal low-accuracy estimation based on the last recorded cell-ID, timingadvance, and measurement report or may attempt a final high-accuracyU-TDOA or AoA location on the remaining mobile transmissions.

Since corresponding radio messages for the Release procedure take placeon the encrypted FACCH, the RNM 82 normally cannot be used to detect theRelease event trigger.

5. Paging

When the network has an incoming call, the mobile station is paged inthe common Paging channel (PCH) when in the idle state. The mobile'sresponse to a page, commonly called a page response, is to request aSDDCH from the wireless network via a Radio Resource Channel Request[3GPP 44.018, 9.1.8] with cause value set to binary 0001xxxx, 0010xxxx,0011xxxx or 100xxxxx where “x” is used to indicate a “don't-care” bitwhere that bit and be either a one or a zero without effecting the causevalue. To minimize the traffic caused by paging, a page request istypically first sent to the Location Area (LA) where the mobile last hada radio transaction with the wireless network as stored in thesubscriber's home location register (HLR) or the visitor locationregister (VLR) of the currently listed service area (Public Land MobileNetwork (PLNM).

Both the RNM 82 and LMS 11 can detect a Paging Response by monitoringthe Radio Resource Channel Request message for the noted cause values.The RNM 82 can demodulate this unencrypted message sent on the RACH. TheLMS 11 can detect the page response either in the initial ChannelRequired [3GPP 48.058, 8.5.3] message or in the subsequent RadioResource Page Response message.

Paging can also be forced when no call is incoming via use of theGSM-MAP Anytime Interrogation procedure and use of supplementaryservices at the MSC. This page will not alert the user and can be usedfor location-applications requiring periodic location updating of anidle mobile. The same non-alerting page is also possible in some systemby sending an SMS message to the mobile device of interest with noalphanumeric content.

The Paging procedure is used when there is a terminating call to amobile device. A mobile termination call is routed towards theoperator's gateway MSC, the Gateway MSC consults HLR, the HLR requestpaging from visited MSC. The visited MSC the pages the handset based onthe last known Location Area. When a page response is received, the HLRis informed. The HLR then sends the visiting MSC address to the gatewayMSC that then routes the call to visited MSC and the mobile terminatingcall is established.

The paging of an MS is initiated by BSC sending a PAGING COMMAND [3GPPTS 48.058, 8.5.5] message to BTS. The message contains the MS identity(TMSI or IMSI), the paging population number of the MS, optionally anindication for the MS about which combination of channels will be neededfor the subsequent transaction related to the paging and optionally anindication of the priority of the call.

The PAGING REQUEST [3GPP TS 44.018, 9.1.22 & 9.1.23 & 9.1.24] messagesto be sent on the dedicated paging channel (PCH) radio path are builtand sent by BTS.

Successful paging of the mobile device results vi the PAGING REQUESTmessage in a page response procedure, that is the use of the initialchannel assignment procedure with the CHANNEL REQUIRED message's causevalue [3GPP TS 24.008, 9.1.8] bit sequence set for “page response”. Atthe end of a successful paging procedure, the Mobile-Terminated CallEstablishment procedure is entered.

During the paging procedure, the LMS can collect the TMSI or IMSI usedin the BSC-to-BTS PAGING COMMAND along with the Location Area Index(LAI) where the mobile last had a successful Location Update. The RNMcan collect the mobile identity information from the PAGING REQUESTmessage. This collected information is stored locally or forwarded toother nodes for resource scheduling purposes or statistical dataanalysis.

6. Identity Response

The Identity Response is sent only in response to an Identity Request,which is, according to 3GPP standards, generated in the GSM-MAP networkby the Equipment Identity Register. The Identity Request and Responsemessages are delivered on the SDCCH, but after encryption so the RNM 82cannot be used to detect the response without encryption key sharing.The LMS 11 can detect the Identity Response on the BTS-BSC interface.The Identity response will include the International Mobile EquipmentIdentity (IMEI) an electronic serial number that uniquely identifies themobile device. The Identity Response can also include the subscriber'sInternational Mobile Station Identifier (IMSI) and the Temporary MobileStation Identity (TMSI).

The Identify Equipment Procedure can be performed when the mobile deviceis on the S-DCCH. The MSC initiates the procedure with a MobilityManagement Direct Transfer Application Part (DTAP) Identity Request[3GPP TS 24.008, 9.2.10] sent via the BSC and BTS to the mobile device.The mobile device responds with a Mobility Management Identity Response[3GPP TS 24.008, 9.2.11] containing the International Mobile EquipmentIdentifier (IMEI) and possibly the TMSI and/or IMSI of the mobiledevice.

Since the Identify Equipment Procedure is typically used after cipheringhas been set, the RNM cannot typically monitor this procedure for IMEIcollection. The LMS can monitor this procedure and collect the IMEI forlocal memory storage or transfer to another system node.

FIG. 2 depicts an exemplary method for the MSC to obtain the IMEI of amobile station in accordance with the present invention. Initially, amobile identity check is elected at step 210. The MSC then will send anIdentity Request to the mobile device via the BSC at step 215. The BSCwill forward the Identity Request without other processing to the BTS atstep 220. The BTS will then transmit the Identity Request to the mobiledevice at step 225. As a result of the received Identity Request at step225, the mobile station will respond by transmitting its IMEI back tothe BTS in an Identity Response message at step 230. Further, if theIMSI and TMSI are required by the identity check parameters, the mobilestation will also transmit the IMSI and TMSI back to the BTS at step230. Dependent on what the BTS receives from the mobile station, the BTSwill forward any MEI, IMSI, or TMSI information in the Identity Responsemessage back to the BSC at step 235. The BSC can then forward theIdentity Response message containing the identity information to the MSCat 240. The MSC will then send a CheckIMEI to the EIR for furtheranalysis of the mobile at step 245.

As a result of the Identity Response message from the mobile station atstep 230, the LMS can obtain a copy of the Identity Response message andcontents from passive monitoring of the Abis or A interface and collectthe IMEI, IMSI, and TMSI information at step 250 pending on what is sentfrom the mobile station at step 230. The LMS can store the IMEI, IMSI,and TMSI information in local memory at step 255. The LMS can alsoforward the MEI, IMSI, and TMSI information, if available, to a LBSapplication for further analysis at step 260.

7. Measurement Report

The Measurement Report (MR) is sent periodically during an active voiceor data session. The MR is used by the mobile device to inform thewireless network of the mobile device's potential need for a handoverand contains downlink (base station to mobile device) measurements onneighboring transmitters (sector antennae or omni directional cellantennae). This technique, called mobile-assisted-handoff (MAHO), iscommon to most cellular radio networks including US TDMA (IS-136), CDMA,GSM, and UMTS. During a voice or data session, the mobile device usesidle time to retune its receiver to monitor the broadcast channels (alsoknown as beacons) of nearby base station antennae. For the serving cell,the mobile measures both the beacon receive level and the receivequality; for all other neighbors in the measurement report, only receivelevel is available. In some spread-spectrum technologies, the path-lossmeasurement is returned rather than the received beacon strength.

The measurement request is only available during an active (encrypted)session on the FACCH and thus the RNM 82 cannot be used without keysharing. The LMS 11 can detect the measurement report on the Abis, orBTS-BSC, interface. Since the measurement report is periodic, the LMS 11can determine call duration. Since the measurement report contains powerlevels, the wireless location system can use the measurement report,timing advance, serving cell and sector information with knowledge ofthe beacon broadcast power levels to perform a hybrid Cell-ID withpower-difference-of-arrival once beacon powers (or path-losses) havebeen normalized.

The measurement report procedure contains a single message of interestfor this invention. The MEASUREMENT RESULT [3GPP TS 48.058 8.4.8]message from BTS to BSC is used to report to BSC the results of radiochannel measurements made by BTS (uplink) and to convey the measurementreports from MS received on SACCH and in the L1 headers. The MEASUREMENTRESULT contains the TCH Channel Number [3GPP TS 48.058, 9.3.1], UplinkMeasurements [3GPP TS 48.058, 9.3.25] and the Base Station Power [3GPPTS 48.058, 9.3.4] and possibly the MS Power [3GPP TS 04.058, 9.3.13],Timing Advance [3GPP TS 48.058, 9.3.24]. and MS Timing Offset [3GPP TS48.058, 9.3.37].

The LMS can detect the MEASUREMENT RESULT and reference to anLMS-internal call record by the TCH Channel Number. The LMS may thenstore the collected information locally or forward the event type, callrecord information and newly collected information to the wirelesslocation system for use in generation of an enhanced Cell-ID locationusing the cell-ID, timing advance, uplink measurements and the MS TimingOffset. The WLS may also use the MEASUREMENT RESULT event as a triggerto perform a high accuracy (U-TDOA and/or AoA based) location estimateon the TCH.

FIG. 3A depicts an exemplary method for an LMS 11 to determine theidentity of a mobile station in accordance with the present invention.At step 310 a mobile station is on a traffic channel. The mobile stationwill periodically measure neighboring CGI beacons to determine theirsignal strength for handover potential at step 320. When the mobilestation performs the measuring of the signal beacon signal strength atstep 320, the mobile station also will report such measuring to the BTSat step 325. The BTS then will report the measurement report to the BSCat step 330. Assuming the LMS 11 is pre-set to detect measurementreports at step 315, the LMS 11 will detect the reporting of themeasurement report at step 335. While the BSC uses the measurementreport for handover purposes at step 340, the LMS 11 can evaluate themeasurement report and channel to determine the identity of the mobilestation at step 345. If the measurement report corresponds to a mobilestation of interest based on the filter analysis performed in step 345,the LMS 11 can forward the event, the mobile station identificationinformation, and measurement report to a LBS application for furtheranalysis at step 350.

8. SMS Origination

An Short Message Service session is originally detectable by both theRNM and the LMS in the initial call setup procedure when the CHANNELREQUIRED message [3GPP TS 48.058, 8.5.3] is sent to the BSC via theRandom Access Channel (RACH). The CHANNEL REQUIRED message Cause Value[3GPP TS 24.008, 9.1.8] field identifies the initial establishment asbeing for an SMS-MO.

For SMS-MO, the initial channel assignment procedure is followed by themobile device sending a CM SERVICE REQUEST [3GPP 24.008, 9.2.9] messageon the S-DCCH to the BTS. The BTS will forward the CM SERVICE REQUEST tothe BSC with then forwards the message to the MSC. The CM SERVICEREQUEST contains the CM service type [3GPP TS 24.008, 10.5.3.3], whichindicates service is being requested for a SMS-MO.

The CM SERVICE REQUEST contains the Mobile Identity field, the firsttime in a mobile origination that the mobile identity [3GPP 24.008,10.5.1.4] is available to the RNM and LMS. The mobile identity will beeither the TMSI or the IMSI only if TMSI is unavailable. The CM ServiceRequest also contains the Mobile Station ClassMark [3GPP TS 44.018,10.5.1.6]. At this point, the LMS or RMS may trigger the wirelesslocation system to perform a location using either cell-ID methods basedon collected Cell-ID and Timing advance data or using a TDOA or AoAtechnique by harnessing the geographically distributed receiver network(the LMU or SCS network) to locate on the radio energy transmitted onthe S-DCCH or by following the current call session to a Traffic channel(TCH) and using the radio energy transmitted from the mobile deviceduring the conversation or data exchange.

Typically, the mobile device will undergo authentication, ciphering,TMSI reallocation and possibly equipment identification procedures whileremaining on the S-DCCH.

FIG. 3B illustrates an exemplary method of the SMS origination triggerin accordance with the present invention. At step 351, the wirelesslocation system (WLS) sets the SMS origination trigger in the LMS. TheLMS can then begin to monitor for any SMS originations at step 352. Whena mobile device begins the SMS origination at step 353, the mobiledevice and wireless network exchange data to setup the SMS exchangedelivery session at step 354. The LMS can then detect the SMSorigination and begin collecting the Cell-ID, Timing Advance, MSID, andfrequency assignment at step 355. Concurrently a channel can be assignedto the mobile device and the SMS delivery can begin at step 356. The SMSdelivery to the wireless network will subsequently end at step 357 andthe mobile device and wireless network can exchange data to tear downthe session and release the resources at step 358.

Based on the collection of information at step 355, the LMS can thenstore the information locally and forward the information to a WLS atstep 359. The WLS can then use the collected information to generateeither a low or high accuracy location of the wireless device at step360.

9. SMS Termination

The SMS—Mobile Terminated (SMS-MT) is initially indicated in the pagingof the mobile device. The paging of an MS for SMS-MT is initiated by BSCsending a PAGING COMMAND [3GPP TS 48.058, 8.5.5] message to BTS. Themessage contains the MS identity (TMSI or IMSI), the paging populationnumber of the MS, optionally an indication for the MS about whichcombination of channels will be needed for the subsequent transactionrelated to the paging and optionally an indication of the priority ofthe call.

The PAGING REQUEST [3GPP TS 44.018, 9.1.22 & 9.1.23 & 9.1.24] messagesto be sent on the dedicated paging channel (PCH) radio path are builtand sent by BTS.

During the paging procedure, the LMS can collect the TMSI or IMSI usedin the BSC-to-BTS PAGING COMMAND along with the Location Area Index(LAI) where the mobile last had a successful Location Update. Thiscollected information is stored locally or forwarded to other nodes forresource scheduling purposes or statistical data analysis.

Successful paging of the mobile device results vi the PAGING REQUESTmessage in a page response procedure, that is the use of the initialchannel assignment procedure with the CHANNEL REQUIRED message's causevalue [3GPP TS 24.008, 9.1.8] bit sequence set for “page response”.

Upon receipt of a SDCCH assignment via the Immediate Assigment Message,the MS sends a PAGING RESPONSE [3GPP 44.018, 9.1.25]. This messagecontains the Mobile Identity field, which would include the TMSI, IMSI,or IMEI. The Mobile identity can be used to identify a subscriber or MSand trigger a location.

FIG. 3C illustrates an exemplary method of the SMS termination triggerin accordance with the present invention. At step 361, the wirelesslocation system (WLS) sets the SMS termination trigger in the LMS. TheLMS can then begin to monitor for any SMS terminations at step 362. Whena mobile device is paged for the SMS termination at step 363, the mobiledevice and wireless network exchange data to setup the SMS deliverysession at step 364. The LMS can then detect the SMS termination andbegin collecting the Cell-ID, Timing Advance, MSID, and frequencyassignment at step 365. Concurrently a channel can be assigned to themobile device and the SMS delivery can begin at step 366. The SMSdelivery to the wireless network will subsequently end at step 367 andthe mobile device and wireless network can exchange data to tear downthe session and release the resources at step 368.

Based on the collection of information at step 365, the LMS can thenstore the information locally and forward the information to a WLS atstep 369. The WLS can then use the collected information to generateeither a low or high accuracy location of the wireless device at step370.

10. Message-type, Message-content, and Complex Triggers

LMS triggers include message-type triggers, when the message itself isthe location triggering event, and triggers based on the contents ofmonitored messages where a network transaction and a filter are bothnecessary. By combining these triggers with LMS stored information, athird type of trigger, the complex trigger, can be produced. Any of thethree types of triggers can be set to cause (trigger) a locationestimation procedure. In general, message-type triggers are tripped inresponse to a mobile station transmission. Message type triggersinclude: (1) Mobile Origination (CM Service Request); (2) MobileTermination (CM Service Request); (3) Identity Response; (4) LocationUpdate; Page Response; (5) Handover; and (6) Release (Channel Release).The LMS 11 can also analyze, in real-time, the contents of specificmessage fields within the triggers. Other such triggers include: (1)Calling-number Trigger; (2) Called-number Trigger; (3) Mobile Identity(MSISDN, IMEI, IMSI, and TMSI) Triggering; (4) CGI/Cell-ID triggering;and (5) LAC triggering.

The LMS maintains tables of Abis, A, and GSM-MAP interface traffic on aper subscriber basis. The LMS 11 may be set to trigger on callconnection events or radio interface events. These events include:

TABLE 1 LMS Detected Network Transactions Network Measurement ReportReceived Mobile Originated Call Placed Mobile Terminated Call ReceivedMobile Originated SMS Sent Mobile Terminated SMS Received Handover(Begins) Handover (Completed) Location Update RF Channel Assignment IMSIAttach IMSI Detach Mobile Originated Call Disconnect Mobile TerminatedCall Disconnect Identity ResponseRetained network information allows for location of subscribers in aspecific area or in proximity to another mobile that is being monitored.

11. Mobile Origination

Mobile Origination is the act of a mobile device placing a call to thewireless network to begin a conversation or data session. MobileOriginations are detectable over the radio interface via a radio networkmonitor (RNM) and by the Link Monitor System. Both high accuracy and lowaccuracy location is possible during the Mobile Origination transactionwith cell-id and timing advance available as well as the frequencyassignment for the S-DCCH for use by specialized receivers.

Using the LMS, the Mobile Origination may be followed to the trafficchannel. Once the mobile is on the traffic channel, the LMS provides thefrequency for subsequent location estimates. Once on the traffic channelthe mobile may experience handover which is covered in a followingsection.

For a Mobile-Originated call establishment, the initial channelassignment procedure is followed by the mobile device sending a CMSERVICE REQUEST [3GPP 24.008, 9.2.9] message on the S-DCCH to the BTS.The BTS will forward the CM SERVICE REQUEST to the BSC with thenforwards the message to the MSC. The CM SERVICE REQUEST contains the CMservice type [3GPP TS 24.008, 10.5.3.3], which indicates service isbeing requested for a Mobile Originated Call.

The CM SERVICE REQUEST contains the Mobile Identity field, the firsttime in a mobile origination that the mobile identity [3GPP 24.008,10.5.1.4] is available to the RNM and LMS. The mobile identity will beeither the TMSI or the IMSI only if TMSI is unavailable. The CM ServiceRequest also contains the Mobile Station ClassMark [3GPP TS 24.088,10.5.1.5, 10.5.1.6 & 10.5.1.7] allowing for classes of LBS servicesbased on mobile manufacturer or model At this point, the LMS or RMS maytrigger the wireless location system to perform a location using eithercell-ID methods based on collected Cell-ID and Timing advance data orusing a TDOA or AoA technique by harnessing the geographicallydistributed receiver network (the LMU or SCS network) to locate on theradio energy transmitted on the S-DCCH or by following the current callsession to a Traffic channel (TCH) and using the radio energytransmitted from the mobile device during the conversation or dataexchange.

Typically, the mobile device will undergo authentication, ciphering,TMSI reallocation and possibly equipment identification procedures whileremaining on the S-DCCH. After completion of these procedures the mobiledevice will transmit the SETUP [3GPP TS 24.008, 9.3.23.2] (for mobileoriginating call establishment) message on the S-DCCH. In the mobileoriginating call establishment case, the SETUP message carries thedialed digits. The RNM and/or LMS can detect the SETUP message andcollect the dialed digits. The dialed digits can then be compared topre-set lists of phone numbers or SMS pins of interest. If the dialeddigits matches a number of interest the RNM or LMS can forward the cellID, timing advance, Mobile Identity (TMSI and/or IMSI), S-DCCH channelassignment, and the nature of the trigger with the digit string to thewireless location system. The wireless location system can then performeither a low accuracy (Cell-ID and Cell-ID with timing advance are bothavailable) or high accuracy (U-TDOA and/or AoA based) location estimatewhile the mobile is on the S-DCCH.

The network will then authenticate the mobile device, set ciphering,could check the IMEI of the mobile device via the Identity Requestprocedure, and could set a new TMSI via the TMSI reallocation procedure.

The next message of significance to this invention in theMobile-Originated call establishment is the ASSIGNMENT COMMAND [3GPP TS44.018, 9.1.2]. The ASSIGNMENT COMMAND carries the Channel Description 2[3GPP TS 44.018, 10.5.2.5a] for the TCH assignment. The LMS can note TCHassignment and link that information to the previously collected eventtype (in this case a call origination, a GPRS data session originationor an SMS origination), the TMSI, the IMSI (if collected), the IMEI (ifcollected), storing that information locally and forward thisinformation to the wireless location system. The wireless locationsystem can then perform a low accuracy (Cell-ID and Cell-ID with timingadvance are both available) or high accuracy (U-TDOA and/or AoA based)location estimate once the mobile moves to the newly assigned trafficchannel.

FIG. 3D illustrates an exemplary method of the Mobile Originationtrigger in accordance with the present invention. At step 371, the WLSsets the mobile origination trigger in the LMS. The LMS can then beginmonitoring for mobile origination at step 372. When a mobile deviceplaces a call at step 373, the mobile device and the wireless networkexchange data to setup the call at step 374. The LMS can detect the callorigination and can begin collecting the Cell-ID, Timing Advance, MSID,and frequency assignment at step 375. Also, a traffic channel isassigned and conversation begins on the mobile at step 376. Theconversation will end at step 377 and the mobile device and wirelessnetwork exchange data to tear down the call and release resources atstep 381.

The LMS can store the collected information locally and forward thecollected information to a WLS for further analysis at step 378. The WLScan use the collected information to perform a high or low accuracylocation of the mobile at step 379. The LMS may also continue to collectinformation for other set triggers at step 380.

12. Mobile Termination

Mobile termination is the act of a mobile device receiving a call fromthe wireless network to begin a conversation or data session. Beginningwith a page and page response sequence, the Mobile Termination isdetectable over the radio interface via a radio network monitor (RNM)and by the Link Monitor System (LMS). Both high accuracy and lowaccuracy location is possible during the Mobile Termination transactionwith cell-id and timing advance available as well as the frequencyassignment for the S-DCCH for use by specialized receivers.

Using the LMS, the Mobile Termination may be followed to the trafficchannel where subsequent location estimates may be made.

The Call Establishment procedure is used when a mobile wants to initiatea voice or data call or respond to a page request.

Following the Initial channel assignment procedure, the mobile devicewill send a CM SERVICE REQUEST [3GPP 24.008, 9.2.9] message on theS-DCCH to the BTS. The BTS will forward the CM SERVICE REQUEST to theBSC with then forwards the message to the MSC. The CM SERVICE REQUESTcontains the Mobile Identity field, the first time in a mobileorigination that the mobile identity [3GPP 24.008, 10.5.1.4] isavailable to the RNM and LMS. The mobile identity (MSID) will be eitherthe TMSI or the IMSI only if TMSI is unavailable.

For mobile terminated call establishment the mobile station shall selectthe same mobile identity type as received from the network in the PAGINGREQUEST message.

For a Mobile-Originated call establishment, initial paging procedure isfollowed by the initial channel assignment procedure. Once on theS-DCCH, the paged mobile device transmits a PAGE RESPONSE [3GPP TS44.018, 9.1.25] with both Mobile Station ClassMark [3GPP TS 44.018,10.5.1.6] and Mobile Identity (MSID) [3GPP TS 44.018, 10.5.1.4]. Boththe MSID and Station ClassMark can be collected by the RNM or LMS. ThePAGE RESPONSE is then forwarded to the BSC and then to the MSC. Both theMSID and Station ClassMark can be collected by the RNM or LMS. The RNMor LMS may then store the collected information (Cell-ID, LAI, S-DCCHassignment, Timing Advance, Page Response Event, MSID, StationClassMark)or forward the collected information to the wireless location system.The WLS may then perform a low accuracy (Cell-ID and Cell-ID with timingadvance are both available) or high accuracy (U-TDOA and/or AoA based)location estimate while the mobile is still on the S-DCCH or byfollowing the current call session to a Traffic channel (TCH) and usingthe radio energy transmitted from the mobile device during theconversation or data exchange.

The network will then authenticate the mobile device, set ciphering,could check the IMEI of the mobile device via the Identity Requestprocedure, and could set a new TMSI via the TMSI reallocation procedure.

The next message of significance to this invention in theMobile-terminated call establishment is the SETUP [3GPP TS 24.008,9.3.23.1 message (for mobile terminated call establishment). The SETUPmessage may contain the call's priority level [3GPP TS 24.008,10.5.1.11], the calling party's number [3GPP TS 24.008, 10.5.4.9], andthe called party (the mobile subscriber) number [3GPP TS 24.008,10.5.4.7]. The LMS can note the SETUP information and link thatinformation to the previously collected event type (in this case a callorigination, a GPRS data session origination or an SMS origination), theTMSI, the IMSI (if collected), the IMEI (if collected)) storing thatinformation locally and forwarding this information to the wirelesslocation system. The wireless location system can then perform a lowaccuracy (Cell-ID and Cell-ID with timing advance are both available) orhigh accuracy (U-TDOA and/or AoA based) location estimate once themobile moves to the assigned traffic channel collected from theASSIGNMENT COMMAND [3GPP TS 44.018, 9.1.2].

The next message of significance to this invention in theMobile-terminated call establishment is the ASSIGNMENT COMMAND [3GPP TS44.018, 9.1.2]. The ASSIGNMENT COMMAND carries the Channel Description 2[3GPP TS 44.018, 10.5.2.5a] for the TCH assignment. The LMS can note TCHassignment and link that information to the previously collected eventtype (in this case a call origination, a GPRS data session originationor an SMS origination), the TMSI, the IMSI (if collected), the IMEI (ifcollected), storing that information locally and forward thisinformation to the wireless location system. The wireless locationsystem can then perform a low accuracy (Cell-ID and Cell-ID with timingadvance are both available) or high accuracy (U-TDOA and/or AoA based)location estimate once the mobile moves to the newly assigned trafficchannel.

FIG. 3E illustrates an exemplary method of the Mobile Terminationtrigger in accordance with the present invention. At step 382, the WLSsets the mobile termination trigger in the LMS. The LMS can then beginmonitoring for mobile terminations at step 383. When a mobile devicereceives a page at step 384, the mobile device and the wireless networkexchange data to setup the call at step 386. The LMS can detect the SMStermination at step 385 and can begin collecting the Cell-ID, TimingAdvance, MSID, and frequency assignment at step 387. Also, a trafficchannel is assigned and conversation begins on the mobile at step 388.The conversation or data session will end at step 389 and the mobiledevice and wireless network exchange data to tear down the call andrelease resources at step 392.

The LMS can store the collected information locally and forward thecollected information to a WLS for further analysis at step 390. The WLScan use the collected information to perform a high or low accuracylocation of the mobile at step 391.

D. Advanced Triggers

Advanced triggers allow for radio or network events (corresponding tospecific messages or groups of messages detectable by the LMS 11 or RNM82) to generate high and low accuracy location estimates. A triggeringevent, one that initiates a location estimation, may be a detection of aparticular message or a field within a specific message. Network events(also called network transactions) include: (1) Mobileoriginations/terminations; (2) SMS originations/terminations; (3) GPRSMobile Attach/Detach events; (4) Location/Routing Update (that is, a GSM“location” update for the purposes of mobility and roaming as opposed toa U-TDOA location event); (5) Handovers; and (6) Call Releases.

1. Dialed Digit Triggering

The wireless location system can locate a mobile based on the numbercalled. This number can be a mobile number, a fixed number, a localnumber, or national/international number of any length. The wirelesslocation system (WLS) can be tasked with any dialled digit trigger atthe LMS. Once the trigger is tasked, the system will automaticallylocate any mobile in the service area dialling the specified number.

For example, the telephone number of the railway safety director may beentered into the LMS 11 system and from that point forward any mobilethat dials those numbers will be automatically located with highaccuracy (and if moving, the speed and direction of travel can bedetermined) if within an LMU equipped area or with lower accuracy ifoutside an LMU equipped area where only Cell ID techniques areavailable.

FIG. 4 depicts an exemplary method of dialed digit triggering inaccordance with the present invention. Initially, at step 410, thedialed digits of interest can be entered into the wireless locationsystem. The number of interest can, for example, be the cell phone of amissing person or the family member of a missing person. The LMS is setto detect all network transactions and a filter is installed to focus ontransactions relating to the dialed digits of interest at step 415. Whena mobile initiates a call or SMS session with the dialed digits ofinterest at step 420, the LMS will detect the call origination at step425. The LMS can then collect the MSID, cell information, and radioinformation form the start-of-call messaging and store the informationin memory at step 430. Assuming the dialed digit string matches thefilter value, or in this case, the dialed digit filter, the LMS willthen task the wireless location system (WLS) with the radio information,MSID, dialed digits, and cell information at step 435. The WLS canperform a high-accuracy location on the mobile or it can convert thecell and radio information into a low accuracy location estimate pendingthe request at step 440. The WLS can then send the location estimate(high accuracy or low accuracy) to the location application for furtheranalysis at step 450. Further, the radio information, MSID, dialeddigits, and cell information can be forwarded on to the locationapplication at step 445 for further analysis. Sometime after the callwas originated at step 430, the mobile device will complete the call orSMS session at step 455.

2. MSID Triggering

The wireless location system can also locate a mobile device by itsidentification. A functioning mobile or user element will have anassociated MSISDN, an International Mobile Station Identity (IMSI) fromthe SIM, and an International Mobile Equipment Identifier (IMEI) fromthe terminal. An IMSI or list of IMSIs can be loaded into the LMS viafile or location based service application. The LMS will then scan Abismessaging traffic until the IMSI-to-TMSI correlation can be verified andretained. The IMSI-TMSI association can be updated with changes when asubsequent TMSI is issued. In either case, the LMS notifies the SMLC ofthe IMSI to TMSI correlation.

An MSISDN or list of MSISDNs can be loaded into the LMS via file orlocation based service application. The LMS can then scan Abis and Ainterface messaging traffic until the MSISDN-to-IMSI and theIMSI-to-TMSI correlations can be discovered and retained. TheMSISDN-IMSI-TMSI association can be updated with changes when asubsequent TMSI is issued. In any case, the LMS can notify the SMLC ofthe MSISDN to IMSI to TMSI correlation.

An IMEI or list of IMEIs can be loaded into the LMS via file or locationbased service application. The LMS will then scan Abis messaging trafficuntil the IMEI-to-IMSI-to-TMSI correlation can be verified and retained.The IMEI-IMSI-TMSI association can be updated with changes when asubsequent TMSI is issued. In either case, the LMS can notify the SMLCof the IEMI to IMSI to TMSI correlation.

Regardless of the original IMEI, IMSI, or MSISDN originally used foridentification, the discovered TMSI will be set as a LMS trigger so thatthe mobile of interest can be located. For example, the MS-ISDN(s),IMEI(s), or IMSI(s) of an individual or group of railway workers, may beentered into the system and from that time forward any networktransaction those mobile devices make can initiate a high accuracylocation for location and mapping purposes. Thus, being able to locateusing the IMEI enables the wireless location system to find SIM-lessphones and devices as well as detecting SIM changes to a particularterminal or user equipment.

FIG. 5A depicts an exemplary method of MSID triggering in accordancewith the present invention. At step 510, the IMSI, IMEI, or MSISDN ofinterest are entered into the system. The LMS can be set to detect allnetwork transactions and filter on IMSI, IMEI, or MSISDN at step 515.When a mobile initiates a network transaction at step 520, the LMS candetect the network transaction at step 525. The LMS can collect theMSID, Cell, and radio information from the transaction message and storeit in memory at step 530. The mobile device will subsequently completethe network transaction at step 555.

When the IMSI, IMEI, or MSISDN matches the filter value entered at step510, the LMS can transfer the MSID, Cell, and radio information to a WLSat step 535. The WLS can then perform a high or low accuracy location ofthe mobile at step 540 and send the location estimate to the locationapplication at step 545. The location application can collect theinformation received from the WLS and the information from the LMS forfurther evaluation and analysis at step 550.

3. Idle Mobile Location

The wireless location system can also locate idle mobile devices anddevices if the IMEI, MSISDN or IMSI of the device is known. The wirelesslocation system can locate idle mobile devices in two ways. First, anidle mobile device can be located by entering the IMSI of the mobiledevice to be located into the LMS 11 system and then by sending a NULLvalue SMS to that mobile. The mobile device will acknowledge the receiptof the SMS message and can be located with high accuracy. The wirelesscarrier can set the host wireless network system parameters so that themobile device will not be alerted when the NULL value SMS is received bythe mobile. Further, updates to the mobile location may be made bysending a NULL value SMS at any time to meet the requirements of the LBSapplication. These SMS messages can be automatically sent by the LBSapplication, for example, and may be set based on quality of serviceparameters.

An alternate method of idle mobile triggering requires the LBSapplication to request the GMLC to submit CAMEL ‘Any-Time-Interrogation’(ATI) queries to the HLR. This can result in a network page being sentto the mobile. The MSC using standardized Supplementary Services, pagesand authenticates the mobile without actually placing the mobile on atraffic channel or otherwise notifying the subscriber. During the pagingand authentication messaging, the wireless location system uses U-TDOAor AoA to process and accurately locate the mobile. A lower accuracyCGI+TA location is automatically generated by this transaction. The GSMService Control Function (gsmSCF) can also be used to cause the GMLC toissue an Anytime Interrogation to request information (e.g., subscriberstate and location) from the HLR at any time. The ATI procedure can beused to transition the MS from the IDLE to Active Signaling State.

For example, the IMSI of an asset (e.g., pet) tracking device may beentered into the Wireless location system and any time the asset ownerwishes to know the location of that mobile. A NULL value SMS may be sentto the mobile or the asset finder location services application caninitiate an ATI message to the GMLC to initiate the location process.Within seconds the asset tracker device will be located with highaccuracy (and if moving, the speed and direction of travel) if within anLMU equipped area or with lower accuracy if outside an LMU equipped areawhere only Cell ID techniques are available.

The preferred method for updating subscriber location from the GMLC isthe AnyTimeInterrogation (ATI) message and procedure defined for CAMELPhase 3 and 4. With the CAMEL Phase 3/4 ATI parameter ‘current location’set to ‘true’, the GMLC can signal the HLR to initiate (force) pagingvia the MSC's supplemental services. For networks with non-CAMEL 3&4compliant GMLC and HLR clusters, a silent SMS based position update maybe possible.

According to the specifications, for silently paging user with SMS theGMLC will send the SMSC (via SMPP interface) a ‘Submit SM’ message usinga Data Coding scheme value of ‘11110110’ (Dec value=246). Delivery ofthis message type should not trigger the MS to alert the user either bysome visual or audible notification. This SMS message has zero user datalength

We suggest that carriers verify a selection of their existing phonesbehavior to the ‘silent’ SMS. A carrier should also check with MSC andSMSC manufacturers as to the operation of the MSC when given the ‘SubmitSM’ message using a Data Coding scheme value of ‘11110110’.

If the ATI is unavailable and the silent SMS cannot be performed withthe existing mobile devices or infrastructure, an alternative may exist.The Provide Subscriber Information (PSI) message, launched from the GMLCto the MSC with ‘force paging’ set to “true”, will page the mobilewithout alerting the subscriber.

FIG. 5B depicts an exemplary method of using AnyTimeInterrogation (ATI)in accordance with the present invention. Initially, the locationapplication sends a location request for low accuracy with MSID to theGMLC at step 560. The GMLC queries the wireless network at step 562. Thewireless network then may find that the mobile is idle at step 564. Thewireless network can use the ATI and supplementary services to page themobile at step 566. The LMS can then detect the page procedure at step568. The mobile device will receive the page and reply with a pageresponse at step 570. The LMS can then detect the page response at step572 and have the WLS perform a high accuracy location at step 580. TheWLS can then send the location estimate to the GMLC or LCS applicationfor further use at step 582. The wireless network can update the HLR/VLRrecords and replies to the GMLC with the low accuracy location at step574. The GMLC can pass the low accuracy location to the LCS applicationat step 576. The location application receives the low accuracy locationat step 578 from the GMLC and the high accuracy location at step 584.

FIG. 5C depicts an exemplary method of using SMS ping in accordance withthe present invention. At step 585, the location application send alocation request for low accuracy with MSID to the GMLC. The GMLCqueries the wireless network at step 586. The wireless network then mayfind that the mobile is idle at step 587. The wireless network then willreturn the last known low accuracy location at step 588. The GMLC willpass the low accuracy location to the LCS application at step 589. Thelocation application then receives the low accuracy location at step590. The GMLC issues a SMS to the mobile at step 591. The wirelessnetwork pages the mobile for the SMS termination at step 592. The LMSdetects the paging at step 593. The mobile device will receive the pageand can reply with a page response at step 594. The LMS will then detectthe page response at step 595. The WLS can then perform a high accuracylocation at step 596. The WLS can then send the location estimate to theGMLC at step 597. The GMLC receives the high accuracy location and sendit to the LCS application at step 598. The Location application receivesthe high accuracy location at step 599 and may further evaluate or storethe location for further use.

4. Historical Cell Location

Mobile phones may be identified and located on the basis of historical,past presence in a defined geographic area as bounded by a covered by asector, a cell or group of cells. The background location feature allowsthe operator to define an area based on cells (CGIs), collect IMSI/TMSIinformation for mobile devices that had a network transaction in thearea of interest, and locate the identified mobile devices on laternetwork transactions. First, the cells or CGI are loaded into theWireless location system. After that point in time an LBS applicationdesires to know all the mobile numbers (and thus the identity) of mobiledevices that were in a specific area during a specific period of timethe LMS is queried. The LMS will produce all mobile identifiers known(IMSI, MSISDN, IMEI) to the application. By tasking the LMS with thecollected mobile identifiers, the mobile devices will then be trackedwith high accuracy as they leave the area of interest.

For example, after a tsunami or hurricane, a group of search and rescuepersonnel, equipped with mobile devices or mobile devices, may beidentified automatically at a rally point and be added automatically toa high accuracy U-TDOA tracking list for further tracking and oversightwithin the stricken area.

FIG. 6 depicts an exemplary method of using historical cell location inaccordance with the present invention. At step 610, events are set toall network transactions. The LMS is set to detect all networktransactions at step 615. When a mobile initiates a network transactionat step 620, the LMS detects the network transaction at step 625 andcollects the MSID, Cell, and radio information from the transaction andstores the information in memory at step 630. Filers can be then set inthe LMS for CGIs of interest at step 640. The LMS can then filter localmemory for the CGIs of interest at step 645. The LMS can then send MSID,Cell, and radio information to the WLS for mobile devices of interest.The WLS can convert the Cell and radio information into a locationestimate at step 655. The WLS can then send the MSID, Cell, and radioinformation along with the location estimate to the location applicationat step 660. The location application can then evaluate and store theinformation for further use at step 665. At some point, the mobiledevice will complete the network transaction at step 635.

5. Cell ID Triggers

Mobile phones may be identified and then located on the basis of a cellID monitored by the LMS. If a mobile makes a network transaction (callorigination, call termination, SMS origination, SMS termination,location update, measurement report or handover) then it will be locatedin the CGI of interest by the monitoring LMS.

Both cell-ID based and high accuracy location is supported for theCell-ID trigger. The Cell ID based location may be the Cell-ID orcell-ID and timing advance (or ½RTT). ECID location is possible when themobile is on a traffic channel. High-accuracy location is possible inareas with deployed LMUs whenever the mobile's channel informationbecomes available to the LMS.

FIG. 7 depicts an exemplary method of using Cell ID triggers inaccordance with the present invention. At step 710, the CGI or CI ofinterest is entered into the system. The LMS is set to detect allnetwork transactions and filter on CGI or CI at step 715. When a mobileinitiates a network transaction at 720, the LMS can detect the networktransaction at step 725. The LMS can then collect the MSID, Cell, andradio information from the transaction and store the information inmemory at step 730.

When the CGI or CI matches a filter value, the LMS can transfer theMSID, Cell, and radio information to the WLS at step 735. The WLS canthen determine the location of the mobile through a high or low accuracylocation at step 740. The WLS can then send the location to the locationapplication at step 745 for further evaluation and storage. The locationapplication can receive the information from the WLS and the LMS at step750. At some point, the mobile device will complete the networktransaction at step 655.

6. Wide-Area Localization Application

Mobile devices can also be identified and located on the basis ofpresence in a defined geographic area under radio coverage by a sector,a cell or group of cells. This historical location feature isaccomplished by loading an area, defined as a set of cells (CGI, CI),into the LMS. The LMS 11 can then develop a list of IMSIs, MSISDNs, andassociated TMSIs that initiate a network transaction (e.g., handover,location update, etc.) in the geographic area of interest. Theidentification and location can also be further filtered by designatinga specific time period. Thus, mobile devices will only be identified andlocated if they were in the designated location at the designated timeperiod.

This application could be used, for example, to determine the identityof all mobile devices in a designated area during a designated timeperiod associated with a fire or emergency event. Cell IDs of interest(CGI or CD) can be loaded into the LMS 11 system that correspond to aparticular part of a city where a fire or an emergency event occurred.After that point in time if the authorities desire to know all themobile numbers (and thus the identity) of individuals that were in aspecific area during a specific period (i.e., the period of time thatthe fire occurred), the list can be available within seconds of therequest. This may be particularly useful in obtaining evidence orwitnesses to an event, for example.

FIG. 8A depicts an exemplary method for detection of mobile devicesbased on location and time in accordance with the present invention. Atstep 801, the events are set to all network transactions. The LMS is setto detect all network transactions at step 802. When a mobile initiatesa network transaction at 803, the LMS can detect the network transactionat step 804. The LMS can then collect the MSID, Cell, and radioinformation from the transaction and store the information in memory atstep 805.

Filters can be set to the CGI of interest and for a specific time periodat step 808. The LMS can then filter local the local memory for CGIs ofinterest for the specified time period at step 807. The LMS can thensend the resulting MSID, Cell, and radio information to the WLS forlocation at step 809. The WLS can then determine the location of themobile at step 810. The WLS can then send the MSID, Cell, radioinformation, and location to the location application at step 811 forfurther evaluation and storage. The location application can receive theinformation from the WLS at step 812. At some point, the mobile devicewill complete the network transaction at step 806.

7. Background Location of All Subscribers

Mobile devices can also be identified and located on the basis ofhistorical or past presence in a defined geographic area as bounded by acovered by a sector, a cell, or group of cells. The background locationfeature can allow an operator to define an area based on cells (CGIs),collect IMSI/TMSI information for mobile devices that had a networktransaction in the area of interest, and locate the identified mobiledevices on later network transactions.

To begin the location, the cells or CGI are loaded into the WirelessLocation System. After that point in time, if an LBS application desiresto know all the mobile numbers (and thus the identity) of mobile devicesthat were in a specific area during a specific period of time, the LMS11 is queried. The LMS 11 will produce all mobile identifiers known(IMSI, MSISDN, IMEI) to the application. By tasking the LMS 11 with thecollected mobile identifiers, the mobile devices will then be trackedwith high accuracy as they leave the area of interest. For example,after a tsunami or hurricane, a group of search and rescue personnel,equipped with mobile devices or mobile devices, may be identifiedautomatically at a rally point and be added automatically to a highaccuracy U-TDOA tracking list for further tracking and oversight withinthe stricken area.

8. Smart Proximity Location

Smart proximity identification allows mobile devices to be identifiedand located on the basis of proximity to another mobile device. Thesmart proximity identification feature allows the operator to obtain alist of all users in the same area as a mobile device of interest. In anavalanche zone, for example, a mobile of a missing skier can be located.A complete list of mobile devices in the same area can also bedetermined. The mobile devices belonging to search and rescue personnelfound in the same geographic area to the mobile of interest will bequeried via Anytime Interrogation (ATI) or NULL value SMS and thehigh-accuracy locations produced will be used to determine the proximityto the mobile of interest. The rescuers can then be directed to themissing or distressed skier.

FIGS. 8B-8D illustrate an exemplary method of Smart Proximity Locationin accordance with the present invention. At step 813, all networkevents can be entered into the system with a MSID filter. The LMS can beset to detect all network transactions at step 814. When a mobileinitiates a network transaction at step 815, the LMS can detect thetransaction at step 816 and collect MSID, Cell, and radio information asa result of the transaction and can store it in memory at step 817.Sometime subsequent to the network transaction, the mobile device willcomplete the transaction at step 818. When a MSID matches apredetermined filter value, the LMS can transfer the MSID, Cell, andradio information to the WLS at step 819. The WLS can perform a low orhigh accuracy location of the mobile at step 820. The LMS and the WLSwill transfer all available information, including the location estimateand Cell ID to a location application at steps 819 and 822 respectively.The location application can then set Cell ID in the LMS at step 821.

The LMS can then search the memory for MSIDs in Cell ID of interest atstep 824. The LMS can then send all the collected MSIDs found to thelocation application at step 825. The location application can then setthe LMS event to page response and filter on any collected MSID at step826. The LMS can then be set to detect page response and filter on anyof the collected MSID at step 828. The location application also cansend a series of location requests with the collected MSIDs at step 829.As a result, the GMLC can perform AnyTimeInterrogations (ATI) for thecollected MSIDs at step 830. If the mobile is idle, the mobile devicecan respond to the ATI induced page at step 831. The LMS can then detectthe page response and match to the collected MSIDs at step 832.

The LMS then can task the WLS with MSID, Cell, and radio information atstep 833. The WLS can then perform a low or high accuracy location ofthe mobile at step 834 and sent the location estimate to the locationapplication at step 835. The LMS can also send the MSID, Cell, and radioinformation to the location application at step 833. The locationapplication will collect all the information at step 836 for furtheruse. At some point in time, the mobile device will complete theATI-induced page response or call at step 837.

9. Geo-Fencing (see FIGS. 8F-8P)

Mobile devices can also be identified and then located with highaccuracy, on the basis of a cell ID-based location as generated by theLMS. A “fenced” area can correspond to the area of a cell (CGI), or setof cells, or can be defined more restrictively/precisely, e.g., by thearea defined by a cell and sector combined with timing advance (TA). Thegeo-fencing feature allows the operator to set specific areas or“restricted” zones based on cell area or sector areas that are used toinitiate high-accuracy locations on mobile devices entering the area orthat get too close to those defined restricted zones.

For example, in one exemplary implementation, the CGI serving an areaadjacent to the restricted zone can be loaded into the wireless locationsystem. From that time forward, any mobile device that enters or leavesthat area will be located by high accuracy U-TDOA so that a securityservice, for example, may investigate the incident. The service may alsocontinue to locate that mobile device or, if the trespass is found to beinnocent, terminate the location. In other embodiments, an individualsubscriber may be notified, for example, by alarm, if he leaves orarrives to a pre-determined geo-fenced area at a time not scheduled.

Mobile devices, regardless of the air interface in use, are designed tomaximize battery life. For this reason, the power-consuming radiotransmitter and receiver are kept in a powered down or standby stateunless the user places a call or initiates a data session or an internaltimer expires. Expiration of an internal timer may cause the phone totransmit or may simply activate the receiver to listen for incomingmessaging. Incoming messages may be addressed directly to the mobiledevice (as in a page) or broadcast by the wireless system to allwireless devices. For purposes of this specification, transmissions by amobile device are referred to as “radio network events”.

As mentioned, the mobile device may be quiescent for long durations,rendering problematic its use as a vehicle for location or tracking.Illustrative embodiments of this invention rely on the use ofunmodified, standardized mobile phones in standard, unaltered operation,a passive network monitoring device, and the designation of geographicalzones or boundaries to enable the class of location-based servicescollectively called “geo-fencing”.

Automatic geo-fencing takes advantage of existing wireless networkparameters and configurations used to control radio traffic. TheLocation Area (LA), the Location Area Code (LAC), and the Location AreaIndex (LAI), and their non-GSM equivalents, are already in use tocontrol delivery of control messaging, data, and voice calls to themobile device by limiting the paging traffic to a geographic areadefined by the wireless operator.

Automatic geo-fencing requires the operator to designate specific areasof interest, or zones, based on wireless service parameters such ascell, sector, paging area, routing area, or other service area. Once anarea has been so designated, the wireless location system can detect andlocate wireless devices and alert others that wireless devices haveentered defined restricted zones or attempted to travel out of thedefined zones. A mobile phone also may cause an alarm if it leaves orarrives at a pre-determined geo-fenced area at a time when it is notexpected or scheduled, for example. Adjustment of wireless networkparameters such as the LAC and establishment of the geo-fenced zones ofinterest could potentially have a non-optimal effect on overall wirelesssystem radio and network traffic, such as the creation of higher pagingvolumes. Geo-fencing, however, may be viewed as a high-valueLocation-based service worthy of perturbing the wireless network.Geo-fencing using wireless system paging configurations was not possiblebefore recent emergency services projects for both low-accuracy (cell-idbased) and high-accuracy (U-TDOA, AoA) network-based location systems.

In addition to the AoA and TDOA location methods described in thepatents listed above, the wireless location system supports loweraccuracy location methods including those based on mapping to a servingcell-ID, serving sector, or a combination of serving cell, sector andhandover candidate measurements called Enhanced Cell ID (ECID).

The passive monitoring devices (radio network monitors (RNM 82))described herein allow for low-accuracy location of mobile phones usingexisting radio network messaging and information. Additional deploymentof overlaid passive receivers covering the geo-fenced area ormodification to existing cell-site receivers will allow forhigh-accuracy (TDOA, AoA) location based on any of a variety of radionetwork events.

A. Detailed Description of Geo-fencing

Geo-Fenced Area

All base station radio transmitters in a PLMN broadcast, via a controlchannel, a Location Area Identity (LAI) code to identify the LocationArea (LA) that the base station transmitter serves. When a mobile deviceis not engaged in a call, it automatically scans the control channelbroadcasts transmitted by the base stations in the locality and selectsa channel delivering the strongest signal. The LAI code broadcast by theselected channel identifies the location area in which the MS iscurrently situated. The LAI code is stored in the Subscriber IdentityModule (SIM) of the mobile equipment. As the MS moves through thenetwork area, the signal received from the selected control channelgradually diminishes in strength and a new stronger signal isdetermined. The MS can re-tune to the newly dominant channel and canexamine the LAI code that the new channel is broadcasting. If thereceived LAI code differs from that stored on the SIM, then the MS hasentered another location area and initiates a location update procedureto report the change to the Mobile Switching Center (MSC). At the end ofthe procedure the LAI code in the SIM is updated.

The Location Area Identity code identifies the location area in a PLMN.The LAI code has three components, including a Mobile Country Code(MCC), a Mobile Network Code (MNC), and a Location Area Code (LAC), asshown in FIG. 8E. The MCC is a 3-digit code that can uniquely identifythe country of domicile of the mobile subscriber (e.g., Germany is 262,and Brunei is 528). The MCC is assigned by the InternationalTelecommunications Union (ITU-T) an international standards organizationunder the auspices of the United Nations). The MNC is a 2-digit codethat identifies the home GSM PLMN of the mobile subscriber. If more thanone GSM PLMN exist in a country, a unique MNC is assigned to each ofthem. The government of each country assigns the MNC 2-digit code.

The LAC component identifies a location area within a PLMN. The LAC hasa fixed length of 2 octets and can be coded using hexadecimalrepresentation. The operator assigns the LAC component of the LAI. FIG.8E depicts an exemplary Location Area Identity (LAI) code.

Static Geo-fenced Area

A static geo-fenced area may be defined by a concatenated set of areascovered by a defined group of CGIs or CIs (i.e., a defined group ofcells). The LMS or RNM can use these CGI or CI groups to filter networkevent triggers. Entry into the covered areas, movement between cells andsectors, and exit out of the covered geographic areas can be detectedfor both idle mobile devices and those in a voice or data session. Sizeof the geo-fenced area may be generally limited by the geographicdistribution of the RNM or by the area monitored by the LMS.

A static geo-fenced area may be created by setting a common LocationArea Code (LAC) in cells or sectors that cover a geo-fenced area; thiscreates a uniquely identified LA (Location Area) within the Public LandMobile Network (PLMN). Thousands of these geo-fenced areas may becreated per GSM wireless network, covering areas from a single sector ormicrocell to clusters up to national or continental size. Entry into andexit out of the covered geographic areas can be detected even if themobile device is idle. The LAC can be used by the LMS or RNM to setnetwork event triggers and limit triggering events only to the area ofinterest.

FIG. 8F is a flowchart of an exemplary process for detecting an idlemobile unit with a static LAC in accordance with the present invention.To begin with, the LAC is set in the BCCH of selected CGIs to cover a“fenced” area (step 838). In addition, the LMS triggers are set for CGIsin the area of interest and for any location update transactions (step839). At step 840, an exemplary mobile unit, which is idle, enters the“fenced” area. The exemplary mobile unit will detect the new locationarea broadcast (i.e., the LAC) in the BCCH (step 841). At step 842, themobile unit can initiate a location update transaction with the wirelessnetwork. The LMS will detect the location update event (step 843) andwill collect mobile identity data, the CGI, and RF channel and deliverthis information to a location application, for example. The locationapplication can then (step 844) evaluate the data using, for example, arules set, and store the mobile identity and CGI, in a database.Concurrently, the LMS can task, pending request type, a WirelessLocation System (WLS) with RF channel information to complete a highaccuracy location of the exemplary mobile (step 845). At some pointsubsequent to the mobile initiating at location update transaction (step842), the mobile unit can complete the location update with the wirelessnetwork and return to an idle state (step 847). Further, once the WLScompletes the high accuracy location of the mobile unit and defines theposition of the mobile unit to the location application (step 846), thelocation application will evaluate and store the high accuracy position(step 848). If further tracking of the mobile is required, the LMS cancontinue to task the WLS to complete high accuracy locations on theidentified mobile unit (not shown).

FIG. 8G is a flowchart of an exemplary process for detecting a mobiledevice during handover. To begin with, the LAC is set in the BCCH ofselected CGIs to cover a “fenced” area (step 849). In addition, the LMStriggers are set for CGIs in the area of interest and triggers forhandover (step 850). At step 851, an exemplary mobile device initiates acall. When the mobile unit enters the proximity of the fenced CGIs (step852), the mobile unit will perform a handover to a CGI within the fencedarea (step 853). The mobile device can then remain on call in the newCGI (step 855).

The LMS detects the handover event (step 854) and can send the CGI,Timing Advance, and the Network Measurement Report (NMR) to the SMLC(step 856). The SMLC can calculate the Enhanced Cell Site ID (ECID)position of the mobile station (step 857). The location application maythen evaluate and store the mobile identity ECID (step 858). The LMS cantask the WLS with the RF channel information and request type (step859). The WLS can complete a high accuracy location and return theposition of the mobile to the location application (step 860). Thelocation application can then evaluate and store the high accuracyposition (step 861). If further tracking of the mobile is required, theLMS can continue to task the WLS to complete high accuracy locations onthe identified mobile (not shown).

FIG. 8H illustrates how a geo-fenced area may be defined. As shown, oneof three sectors at each site in the exemplary configuration areselected, and it is the joint coverage areas of these sectors thatdefine the geo-fenced are. In this example, four sectors are used todefine a six-sided geo-fenced region. The selected sectors may be partof an antenna configuration at a BTS or a stand-alone LMU.

FIG. 8I is a flowchart of an exemplary process for detecting a mobileusing proximity detection in accordance with the present invention.Initially, the LAC is set in the BCCH of selected CGIs to cover a“fenced” area (step 862). In addition, the LMS triggers are set for CGIsin the area of interest for NMRs (step 863). At step 864, an exemplarymobile device is determined to be on call. When the mobile device entersthe proximity of the fenced CGIs (step 865), the mobile device will adda CGI from the fenced group to the NMR (step 866). The mobile device canthen remain on call (step 868). The LMS, however, detects the NMR listcontaining the fenced CGI (step 867) and can send the CGI, TimingAdvance, and the Network Measurement Report (NMR) to the SMLC (step869). The SMLC can calculate the Enhanced Cell Site ID (ECID) positionof the mobile station (step 870). The location application can evaluateand store the mobile identity ECID (step 871). The LMS can task the WLSwith the RF channel information and request type (step 872). The WLS cancomplete a high accuracy location and return the position of the mobiledevice to the location application (step 873). The location applicationcan then evaluate and store the high accuracy position (step 874). Iffurther tracking of the mobile device is required, the LMS can continueto task the WLS to complete high accuracy locations on the identifiedmobile (not shown).

Dynamic

Dynamic changes to a cell's location area code (LAC) can be used toprovoke idle mobile devices to transmit and thus create a low-accuracy,cell ID-based location estimate or, in areas with installed overlayreceivers, create the opportunity for a high-accuracy network-based(U-TDOA, AoA or hybrid U-TDOA/AoA) location estimate. As a result of thechanges in the LAC, mobile devices currently in conversation canexperience a handoff or can be released but allowed to redial and resumeconversation in short order.

An alternative embodiment of the dynamic LAC allocation occurs where ahigh power, possibly mobile, standalone BTS with a unique LAC is used toprovoke the mobile devices in the cell's coverage area into performing aLocation Update. Detrimental effects on the wireless system can beexpected, but can be confined to the coverage area of the standalone BTSand the surrounding cells.

FIG. 8J is a flowchart of an exemplary process for dynamically detectinga mobile device using geo-fencing. Initially, an original LAC is set inthe BCCH for all CGIs in the system (step 875). The mobile device ofinterest is idle in the selected area (step 876). The LAC can then bechanged in the BCCH for selected CGIs of the fenced area of interest(step 877). Also, the LMS triggers can be set for location updatetransactions optionally with selected CGIs as a filter (step 888). Theidle mobile device in the fenced area can then detect the new locationarea broadcast in the BCCH (step 889). The mobile device will initiate alocation update transaction with the network (step 890). The LMS candetect the location update event and collect mobile identity data, CGI,and RF channel information and deliver such information to a locationapplication (step 891). Subsequently, the mobile device will completethe location update transaction and return to an idle state in thefenced area (step 894).

The location application can evaluate, store, or forward the mobileidentity and CGI to an LBS application at step 892. Further, the LMS cantask a wireless location system with RF channel information and requesttype (step 893). The WLS can complete a high accuracy location andreturn the mobile unit's position to the location application (step895). The location application can evaluate, store, and/or forward thehigh accuracy position on to an LBS application (step 896). The LBSapplication can then evaluate the information collected (step 897). Iffurther tracking of the mobile is required, the LMS can continue to taskthe WLS to complete high accuracy locations on the identified mobile(not shown).

Geo-fencing Option 1

As shown in FIG. 8K, receivers (LMUs) may be installed at existing cellsites or standalone locations with a central processing node (the SMLC)serving the deployed LMUs. The LMUs can determine the local BCCH,establishing the timing and framing of the BCCH. The LMUs can thendetermine the local Access Channels or can be preset to scan a range ofaccess channels. The LMUs can detect a mobile device attempting to usethe RACH (or other uplink channels) to access the local GSM network.Once detected, the LMUs in the immediate area can be tasked to locatethe accessing mobile.

This geo-fencing application would therefore not detect idle mobiledevices or those that move into the geo-fenced area while on a call.Identity of the mobile or the subscriber would not be determined by thissystem, but interface to non-location nodes could provide the necessaryTMSI-IMSI-MSIDN mapping.

Standalone receivers can be used to improve the coverage and geometry ofthe covered area. The geometry of the network can be used to minimizethe effects of Geometric Dilution of Precision (GDOP) present in allTDOA-based location systems, or to maximize the signal to noise ratio(SNR). Improvements in GDOP or SNR would yield a more accurate locationestimate.

In FIG. 8K, BTSs (not shown) in cells 10, 11, 12, 13, 14 are equippedwith RNMs 82 (not shown), thus setting the size and shape of thegeo-fenced area.

Geo-fencing Option 2

As shown in FIG. 8L, receivers (RNMs) can be installed at existing cellsites or standalone locations with a central processing node (the SMLC)serving the deployed RNMs. The Location Area Code (the LAC) is set to beunique in the geo-fenced area with all BCCHs in the geo-fenced areausing the same LAC.

The RNMs can determine the local BCCH, establishing the timing andframing of the BCCH. The RNM can then determine the local accesschannels or can be preset to scan a range of access channels. The RNMcan detect mobile devices attempting to use the RACH (or other uplinkchannels) to access the local GSM network. Once detected, the RNMs inthe immediate area would be tasked to locate the accessing mobile.

Since the LAC is unique to the geo-fenced area, idle mobile deviceswould perform a Location Update upon moving into the geo-fenced area. Anon-call mobile device would perform a Location Update on completion ofthe call. In either case, the monitoring RNMs would detect the LocationUpdate and perform a location estimate on the triggering mobile unit.

Standalone receivers can be used to improve the coverage and geometry ofthe covered area. Network geometry can be used to minimize the effectsof Geometric Dilution of Precision (GDOP) present in all TDOA-basedlocation systems or to maximize the SNR. Improvements in GDOP or SNRwould yield a more accurate location estimate. Identity of the mobile orthe subscriber would not be determined by this system, but interface tonon-location nodes (MSCNVLR or HLR) could provide the necessaryTMSI-IMSI-MSIDN mapping.

In the implementation represented by FIG. 8L, cells 7, 8, 14, 15, 16, 18and 19 are equipped with RNMs. Cell 15 has been set to broadcast alocally unique Location Area Code on the Broadcast Control Channel(BCCH). It is the LAC that defines the geo-fenced are size andboundaries.

Geo-fencing Option 3

As depicted in FIG. 8M, geo-fencing using the Links Monitoring System(LMS) (or similar facility built into the base station controller (BSC)or Radio Network Controller (RNC)) may be performed with the LMS set totrigger on mobile network transactions. These network transactionsinclude Mobile Originations, Mobile Terminations, Location Updates,Short-Message-Service originations, and SMS terminations as well asother control channel procedures such as handover.

By monitoring the links between the base transceiver station(s) (BTS)and BSC, the LMS can detect these events. By link-selective monitoring,or by filtering the triggers based on cell ID, the LMS can be used tocreate arbitrary geo-fenced areas based on cell or sector coverageareas.

The LMS can then determine a location estimate for a triggering mobiledevice using the information available on the Abis (or Iub) link. Usingthe information collected by the LMS, the WLS can compute low-accuracyCell-ID based locations.

The lowest accuracy, CGI or CI method, is simply the reporting of thelatitude and longitude of the serving cell tower or the center of theserving sector. A more accurate location estimate can be computed usingboth the cell-ID (CGI in GSM or CI in UMTS) and the timing advance (TA)(also used in UMTS as ½ round-trip-time (RTT) originally used by thewireless system to synchronize the mobile device's uplink messaging.Conversion of the timing advance (TA) to distance (multiplying by thespeed-of-light in air) yields a range estimate from the cell tower tothe mobile device.

Using the CGI+TA (or CI+RTT) location technique, the reported locationis the intersection of the area formed by timing granularity of thetiming advance measurement (554 meters in GSM, 39 meters in UMTS) andthe bisector of the serving sector. In the case of an omni-directional,single sector cell, the reported location for the CGI+TA or CI+RTTmethod is the latitude and longitude of the serving cell tower.

The potentially most accurate cell-ID based location technique, calledEnhanced Cell ID (ECID), uses LMS collected information on the servingcell, serving sector and timing advance combined with beacon powermeasurements taken by the mobile station normally used for thedetermination of handover candidates. By combining the cell-ID, sectorinformation, and timing advance with a power-difference-of-arrivalcalculation based on the LMS collected power measurements (or path-lossmeasurements in UMTS) from neighboring cells beacons, the WLS canpotentially compute a more accurate location than the use of cell-ID orcell-ID with timing advance alone. Factors such as geometry of theneighboring cells, the RF environment and the number of measured beaconscan limit the usefulness of ECID.

This geo-fencing application does not detect idle mobile devices but candetect and estimate location for mobile devices on-call, entering (orexiting) the area and undergoing the handover procedure. Identificationof the mobile or the subscriber is not guaranteed by this system, butinterface to non-location nodes, such as the MSCNVLR or HLR couldprovide the necessary TMSI-IMSI-MSIDN mapping.

In the implementation of FIG. 8M, the LMS has been preset with triggersfor radio network transactions and uses filters to limit forwardedevents to the WLS. It is the use of filtering that defines thegeo-fenced area to cells 7, 8 and 15

Geo-fencing Option 4

As depicted in FIG. 8N, geo-fencing using the LMS (or similar facilitybuilt-into the base station controller (BSC) or Radio Network Controller(RNC)) is possible with the LMS set to trigger on mobile networktransactions. These network transactions include Mobile Originations,Mobile Terminations, Location Updates, Short-Message-Serviceoriginations, and SMS terminations as well as other control channelprocedures such as handover and page response. The inclusion of aGateway Mobile Location Center (GMLC) allows the system to periodicallyre-locate triggering mobile devices. The GMLC also allows the collectionof identity information based on HLR lookups for triggering mobiledevices.

By monitoring the links between the BTS and BSC, the LMS can detectthese events. By link selective monitoring, or by filtering the triggersbased on cell ID, the LMS can be used to create arbitrary geo-fencedareas based on cell or sector coverage areas. The LMS would thendetermine a location estimate for a triggering mobile device using theinformation available on the Abis (or Iub) link. Using the informationcollected by the LMS, the WLS can compute low-accuracy Cell-ID basedlocations. The lowest accuracy, CGI or CI method, is simply thereporting of the latitude and longitude of the serving cell tower or thecenter of the serving sector. A more accurate location estimate can becomputed using both the cell-ID (CGI in GSM or CI in UMTS) and thetiming advance (TA) (also used in UMTS as ½ round-trip-time (RTT)originally used by the wireless system to synchronize the mobile unit'suplink messaging. Conversion of the TA to distance yields a rangeestimate from the cell tower to the mobile device.

Using the CGI+TA (or CI+RTT) location technique, the reported locationis the intersection of the area formed by timing granularity of thetiming advance measurement (554 meters in GMS, 39 meters in UMTS) andthe bisector of the serving sector. In the case of an omni-directional,single sector cell, the reported location for the CGI+TA or CI+RTTmethod is the latitude and longitude of the serving cell tower.

The potentially most accurate cell-ID based location technique, calledEnhanced Cell ID (ECID), uses LMS collected information on the servingcell, serving sector and timing advance combined with beacon powermeasurements taken by the mobile station normally used for thedetermination of handover candidates. By combining the cell-ID, sectorinformation, and timing advance with a power-difference-of-arrivalcalculation based on the LMS collected power measurements (or path-lossmeasurements in UMTS) from neighboring cells beacons, the WLS canpotentially compute a more accurate location then the use of cell-ID orcell-ID with timing advance alone. Factors such as geometry of theneighboring cells, the RF environment and the number of measured beaconscan limit the usefulness of ECID.

The GMLC can be tasked by the SMLC node to query the HLR for identityinformation on LMS detected mobile devices as well as being tasked toissue Any Time Interrogation (ATI) messages to the Mobile SwitchingCenter (MSC) to cause the mobile to transmit a Page Response messagesequence over the radio interface.

This geo-fencing application would not detect idle mobile devices butcould detect and estimate location for mobile devices on-call, entering(or exiting) the area and undergoing the handover procedure.Identification of the mobile or the subscriber would not be guaranteedby this system, but interface to non-location nodes could provide thenecessary TMSI-IMSI-MSIDN mapping.

In the embodiment of FIG. 8N, the LMS monitors cells 1-21 and has beenpreset with triggers for radio network transactions and uses filters tolimit forwarded events to the wireless location system. It is the use offiltering that defines the geo-fenced area to cells 7, 8 and 15. Theaddition of the GMLC allows for periodic low-accuracy location anywherein the LMS coverage area (cells 1-21).

Geo-fencing Option 5

As depicted in FIG. 8O, geo-fencing an arbitrary geographic area, usingthe Link Monitoring System (LMS) (or similar facility built-into thebase station controller (BSC) or Radio Network Controller (RNC)) canoccur with the LMS set to trigger on mobile network transactions. Thesenetwork transactions include Mobile Originations, Mobile Terminations,Location Updates, Short-Message-Service originations, and SMSterminations as well as other control channel procedures such ashandover and page response.

By monitoring the links between the base station (BTS) and BSC, the LMScan detect these events. By link selective monitoring, or by filteringthe triggers based on cell ID, the LMS can be used to create arbitrarygeo-fenced areas based on cell or sector coverage areas. By setting theLAC to be unique to the geo-fenced area, the LMS can be triggered forthe Location Update generated by each mobile device entering thegeo-fenced area. The LMS could then determine a location estimate forany triggering mobile using the information available on the Abis (orIub) link. Using the information collected by the LMS, the WLS cancompute low-accuracy Cell-ID based locations.

The lowest accuracy, CGI or CI method, is simply the reporting of thelatitude and longitude of the serving cell tower or the center of theserving sector. A more accurate location estimate can be computed usingboth the cell-ID (CGI in GSM or CI in UMTS) and the timing advance (TA)(also used in UMTS as ½ round-trip-time (RTT) originally used by thewireless system to synchronize the mobile unit's uplink messaging.Conversion of the Timing Advance to distance yields a range estimatefrom the cell tower to the mobile device.

Using the CGI+TA (or CI+RTT) location technique, the reported locationis the intersection of the area formed by timing granularity of thetiming advance measurement (554 meters in GMS, 39 meters in UMTS) andthe bisector of the serving sector. In the case of an omni-directional,single sector cell, the reported location for the CGI+TA or CI+RTTmethod is the latitude and longitude of the serving cell tower.

The potentially most accurate cell-ID based location technique, calledEnhanced Cell ID (ECID), uses LMS collected information on the servingcell, serving sector and timing advance combined with beacon powermeasurements taken by the mobile station normally used for thedetermination of handover candidates. By combining the cell-ID, sectorinformation, and timing advance with a power-difference-of-arrivalcalculation based on the LMS collected power measurements (or path-lossmeasurements in UMTS) from neighboring cells beacons, the WLS canpotentially compute a more accurate location then the use of cell-ID orcell-ID with timing advance alone. Factors such as geometry of theneighboring cells, the RF environment and the number of measured beaconscan limit the usefulness of ECID.

For mobile devices entering the geo-fenced area, the change in the LACwould cause the mobile devices to perform a Location Update procedure.Since identification information (the IMSI and usually the IMEI) isexchanged during the Location Update procedure, the LMS would then havea location estimate and mobile and subscriber information.

This geo-fencing application would not detect idle mobile devices butcould detect and estimate location for mobile devices on-call, entering(or exiting) the area and undergoing the handover procedure if the linkmonitoring system (LMS) is available.

In the implementation of FIG. 8O, the LMS monitors cells 1-21 and hasbeen preset with triggers for radio network transactions and usesfilters to limit forwarded events to the wireless location system. Inaddition, cells 7, 12, and 15 have been set to broadcast a locallyunique Location Area Code on the Broadcast Control Channel (BCCH). It isthe LAC that defines the geo-fenced area size, shape and boundaries.Once detected in the geo-fenced area, the mobile device can then belocated to low accuracy when transmitting in any of the cells 1-21.

Geo-fencing Option 6

As depicted in FIG. 8P, geo-fencing an arbitrary geographic area can becombined with a high-accuracy U-TDOA system based on geographicallydistributed receivers (LMUs), a central processing node (the SMLC), andLink Monitoring System (the LMS) and a Gateway Mobile Location Center(GMLC).

With the LMS (or similar facility built-into the base station controller(BSC) or Radio Network Controller (RNC)), it is possible within the LMSto set triggers for mobile network transactions. These networktransactions include Mobile Originations, Mobile Terminations, LocationUpdates, Short-Message-Service originations, and SMS terminations aswell as other control channel procedures such as handover and pageresponse.

By monitoring the links between the base transceiver station (BTS) andBSC, the LMS can detect these events. By link selective monitoring, orby filtering the triggers based on cell ID, the LMS can be used tocreate arbitrary geo-fenced areas based on cell or sector coverageareas. By setting the LAC to be unique to the geo-fenced area, the LMScan be triggered for the Location Update generated by each mobile unitentering the geo-fenced area. The LMS would then determine a locationestimate for any triggering mobile device using the informationavailable on the Abis (or Iub) link. Using the information collected bythe LMS, the WLS can compute low-accuracy Cell-ID based locations.

The lowest accuracy, CGI or CI method, is simply the reporting of thelatitude and longitude of the serving cell tower or the center of theserving sector. A more accurate location estimate can be computed usingboth the cell-ID (CGI in GSM or CI in UMTS) and the timing advance (TA)(also used in UMTS as ½ round-trip-time (RTT) originally used by thewireless system to synchronize the mobile unit's uplink messaging.Conversion of the Timing Advance to distance (multiplying by thespeed-of-light in air) yields a range estimate from the cell tower tothe mobile device.

Using the CGI+TA (or CI+RTT) location technique, the reported locationis the intersection of the area formed by timing granularity of thetiming advance measurement (554 meters in GMS, 39 meters in UMTS) andthe bisector of the serving sector. In the case of an omni-directional,single sector cell, the reported location for the CGI+TA or CI+RTTmethod is the latitude and longitude of the serving cell tower.

The potentially most accurate cell-ID based location technique, calledEnhanced Cell ID (ECID), uses LMS collected information on the servingcell, serving sector and timing advance combined with beacon powermeasurements taken by the mobile station normally used for thedetermination of handover candidates. By combining the cell-ID, sectorinformation, and timing advance with a power-difference-of-arrivalcalculation based on the LMS collected power measurements (or path-lossmeasurements in UMTS) from neighboring cells beacons, the WLS canpotentially compute a more accurate location then the use of cell-ID orcell-ID with timing advance alone. Factors such as geometry of theneighboring cells, the RF environment and the number of measured beaconscan limit the usefulness of ECID.

The LMS can also determined RF channel information from the monitoredmessaging and deliver such information to the SMLC. The SMLC will taskthe local RNMs to collect TDOA information on the signal of interestfrom the triggering mobile, resulting in a high-accuracy location.

The GMLC can be tasked by the SMLC node to query the HLR for identityinformation on LMS detected mobile devices as well as being tasked toissue Any Time Interrogation (ATI) messages to the Mobile SwitchingCenter (MSC) to cause the mobile to transmit a Page Response messagesequence over the radio interface. This page response can in turntrigger an LMS-based, low accuracy (CGI, CGI+TA or ECID) locationestimate or a high-accuracy U-TDOA location calculated by the SMLC andspecialized receiver (LMU or SCS) network.

FIG. 8P shows cells 7, 12 and 15 have been set to send over the BCCH alocally unique Location Area Code (LAC). Cells 3, 4, 6, 7, 8, 9, 10, 11,12, 13, 14, 15, 16, 18, and 19 have all been equipped with RNMs. An LMSservices all cells 1-21. While the geo-fenced area is defined by the LAC(cells 7, 12, 15) and is able to locate mobile devices in the geo-fencedarea with high accuracy, a low accuracy location remains possible forall cells 1-21. The addition of a GMLC allows for future locationestimates for mobile devices that once entered into the geo-fenced areaor left the geo-fenced area.

10. Emergency Alerts

The Emergency Alert location-based application allows for geographicallytargeted messaging to mobile devices in the case of an emergency similarto the United States radio and television Emergency Alert System. A TDOAand AoA system using the RNM or LMS in accordance with the presentinvention provides for wide area localization and subsequent highvolume, accurate location of mobile stations in the selected area. Oncemobile devices have been located in the area of interest, SMS messaging,MMS, or a recorded voice message can be used to warn and provideinstructions to the targeted population.

For extremely large areas where high-accuracy precision location isunnecessary or when extremely high affected populations need to bewarned, the Finder wireless location system may use lower-accuracycell-ID based location estimates to find the affected populations toalert.

11. Calling Number Triggering

The WLS can locate a mobile based on the number calling the mobile. Thisnumber can be a mobile, fixed, local, and national or any lengthinternational number. The wireless location system can be tasked withany dialled digit trigger at the RNM or LMS. Once the trigger is tasked,the system will automatically locate any mobile in the service areacalled by the specified number.

FIG. 9 is a flowchart of an exemplary process for detecting a mobileusing calling number triggering in accordance with the presentinvention. Initially, at step 910, the MSISDN of interest is entered inthe system. The LMS is set to detect all network transactions and filteron MSISDN of calling number at step 915. A mobile device can theninitiate a network transaction at step 920. The LMS can then detect thetransaction at step 925 and collect the MSID, Cell, and radioinformation from the transaction messaging and store that informationinto memory at step 930.

If the MSISDN matches the filter value MSISDN, the LMS can transfer theMSID, Cell, and radio information to a WLS at step 935. The WLS can thenperform a high or low accuracy location at step 940. The WLS can thensend the location to a location application at step 945. As some timesubsequent to the mobile initiating a network transaction, the mobiledevice will complete the transaction at step 955. The locationapplication will receive information from the WLS and the LMS and storefor further evaluation at step 950.

E. Conclusion

The true scope the present invention is not limited to the illustrativeembodiments disclosed herein. For example, the foregoing disclosure of aWireless Location System uses explanatory terms, such as LMU, LMS, RNM,BTS, BSC, SMLC, and the like, which should not be construed so as tolimit the scope of protection of this application, or to otherwise implythat the inventive aspects of the Wireless Location System are limitedto the particular methods and apparatus disclosed. Moreover, as will beunderstood by those skilled in the art, many of the inventive aspectsdisclosed herein may be applied in location systems that are not basedon TDOA or AoA techniques. In such non-TDOA/AoA systems, the SMLCdescribed above would not be required to perform TDOA or AoAcalculations. Similarly, the invention is not limited to systemsemploying LMU(s), LMS(s) and/or RNM(s) constructed in a particularmanner, or to systems employing specific types of receivers, computers,signal processors, etc. The LMUs, SMLC, etc., are essentiallyprogrammable data collection and processing devices that could take avariety of forms without departing from the inventive concepts disclosedherein. Given the rapidly declining cost of digital signal processingand other processing functions, it is easily possible, for example, totransfer the processing for a particular function from one of thefunctional elements (such as the SMLC) described herein to anotherfunctional element (such as the LMU) without changing the inventiveoperation of the system. In many cases, the place of implementation(i.e., the functional element) described herein is merely a designer'spreference and not a hard requirement. Accordingly, except as they maybe expressly so limited, the scope of protection is not intended to belimited to the specific embodiments described above.

In addition, any reference herein to control channels or voice channelsshall refer to all types of control or voice channels, whatever thepreferred terminology for a particular air interface. Moreover, thereare many more types of air interfaces (e.g., IS-95 CDMA, CDMA 2000, andUMTS WCDMA) used throughout the world, and, unless the contrary isindicated, there is no intent to exclude any air interface from theinventive concepts described within this specification. Indeed, thoseskilled in the art will recognize other interfaces used elsewhere arederivatives of or similar in class to those described above.

1. A system for use in or by a wireless communications system,comprising: a links monitoring system (LMS) for monitoring one or moresignaling links of the wireless communications system; a mechanism fordefining a geo-fenced area by setting a common Location Area Code (LAC)in a broadcast control channel (BCCH) of a plurality of cells or sectorsthat cover an area to be geo-fenced, thereby enabling detection of amobile device's entry into and exit out of the geo-fenced area bycausing at least one of an automatic, mobile device initiated, locationupdate transaction, a handover transaction, and a Network MeasurementReport (NMR) transaction; and a mechanism for detecting that a mobiledevice has performed any of the following acts with respect to thegeo-fenced area: (1) entered said geo-fenced area, (2) exited saidgeo-fenced area, and (3) come within a predefined degree of proximitynear said geo-fenced area; wherein the system is configured to define astatic geo-fenced area by setting a common LAC in a plurality of cellsor sectors that cover a specified area to be geo-fenced, whereby entryinto and exit out of the geo-fenced area is detectable even if themobile device is idle before the entry and exit; wherein the system isconfigured to use a process for detecting an idle mobile device, theprocess comprising: setting a LAC in a BCCH of selected cells so as todefine the geo-fenced area; setting triggers for cell global identities(CGIs) in the geo-fenced area and for any location update transactions;in response to an idle mobile device entering the geo-fenced area,detecting the LAC broadcast in the BCCH, initiating a location updatetransaction, detecting the location update transaction, and collectingdata concerning mobile identity, CGI, and radio frequency (RF) channel;and delivering the data to a location application; wherein the system isconfigured to use a process for detecting a mobile device duringhandover, the process comprising: setting a LAC in a BCCH of selectedcells; setting triggers for CGIs in the geo-fenced area and for anyhandover transactions; and detecting a mobile device's presence in thegeo-fenced area when the mobile device enters the proximity of thegeo-fenced area and performs a handover to a CGI within the geo-fencedarea; and wherein the system is configured to use a process fordetecting a mobile device using proximity detection, the processcomprising: setting a LAC in a BCCH of selected cells defining thegeo-fenced area; setting triggers for CGIs in the geo-fenced area andfor any NMR transactions; and in response to a mobile device on a callentering the proximity of the geo-fenced area, adding a CGI from thegeo-fenced area to an NMR and detecting an NMR list containing ageo-fenced CGI.
 2. A system as recited in claim 1, wherein the mechanismfor defining a geo-fenced area is configured to use existing wirelesscommunications system parameters, including any of: the Location Area(LA), the Location Area Code (LAC), and the Location Area Index (LAI),and their non-GSM equivalents.
 3. A system as recited in claim 1,wherein the mechanism for defining a geo-fenced area comprises adeployment of location measuring units (LMUs) at selected sites.
 4. Asystem as recited in claim 1, wherein said geo-fenced area comprises ageographic area contained within at least one cell of the wirelesscommunications system.
 5. A system as recited in claim 1, wherein saidgeo-fenced area comprises a geographic area contained within a pluralityof cells of the wireless communications system.
 6. A system as recitedin claim 1, wherein said geo-fenced area comprises a geographic areadefined, in part, by at least one sector of a cell of the wirelesscommunications system.
 7. A system as recited in claim 1, wherein saidgeo-fenced area comprises an area whose perimeter is defined by thejoint coverage areas of a plurality of base transceiver station (BTS)antennae sectors.
 8. A system as recited in claim 1, wherein saidgeo-fenced area comprises an area whose perimeter is defined by thejoint coverage areas of a plurality of location measuring unit (LMU)antennae sectors.
 9. A system as recited in claim 1, further comprisinga mechanism for triggering a high-accuracy, uplink time difference ofarrival (U-TDOA)-based location function for determining the geographiclocation of said mobile device.
 10. A system as recited in claim 9,wherein said high-accuracy location function comprises the use of plurallocation measuring units (LMUs) and U-TDOA algorithms.
 11. A system asrecited in claim 9, wherein said high-accuracy location functioncomprises the use of at least one location measuring unit (LMU) anduplink angle of arrival (AoA) algorithms.
 12. A system as recited inclaim 9, wherein said high-accuracy location function comprises the useof plural location measuring units (LMUs) and hybrid U-TDOA and angle ofarrival (AoA) algorithms.
 13. A system as recited in claim 1, furthercomprising a mechanism for triggering a low-accuracy, CGI based locationfunction for determining the geographic location of said mobile device.14. A system as recited in claim 1, further comprising a mechanism fortriggering a medium-accuracy, enhanced cell ID (ECID)-based locationfunction for determining the geographic location of said mobile device.15. A system as recited in claim 1, wherein said predefined signalinglinks include an Abis link between a base transceiver station (BTS) anda base station controller (BSC).
 16. A system as recited in claim 1,wherein said predefined signaling links include an A link between a basestation controller (BSC) and a mobile switching center (MSC).
 17. Asystem as recited in claim 1, wherein said predefined signaling linksinclude a GSM-MAP link.
 18. A system as recited in claim 1, wherein saidpredefined signaling links include an Iub link.
 19. A system as recitedin claim 1, wherein said predefined signaling links include an Iu-PSlink.
 20. A system as recited in claim 1, wherein said predefinedsignaling links include an Iu-CS link.
 21. A system as recited in claim1, further comprising a radio network monitor (RNM) configured tomonitor a radio link between a base transceiver station (BTS) and awireless device.
 22. A system as recited in claim 21, wherein the RNM isconfigured to monitor RACH and SDCCH messages.
 23. A system as recitedin claim 1, wherein said LMS is configured for passively monitoring saidset of predefined links such that the operation of said wireless deviceand said wireless communications system is unaffected by saidmonitoring.
 24. A system as recited in claim 1, wherein said system isincorporated into a wireless location system (WLS), and said WLS isoverlaid on said wireless communications system.
 25. A system as recitedin claim 1, further comprising a radio network monitor (RNM) and amechanism for using cell ID or cell global identity (CGI) information tolocate the mobile device.
 26. A system as recited in claim 25, furthercomprising a mechanism for using CGI plus Timing Advance (CGI+TA)information to locate the mobile device.
 27. A system as recited inclaim 26, further comprising a mechanism for using an NMR in combinationwith enhanced cell ID (ECID, or CGI+TA+NMR) information to locate themobile device.
 28. A system as recited in claim 1, wherein said systemis configured to employ a mapping of a serving cell-ID, serving sector,or a combination of serving cell, sector and handover candidatemeasurements as contained in an NMR.
 29. A system as recited in claim 1,wherein said system is configured to detect at least one predefinednetwork transaction occurring on at least one signaling link.
 30. Asystem as recited in claim 29, wherein said at least one predefinednetwork transaction comprises a Location Update transaction.
 31. Asystem as recited in claim 29, wherein said at least one predefinednetwork transaction comprises an Identity Request transaction.
 32. Asystem as recited in claim 29, wherein said at least one predefinednetwork transaction comprises a Network Measurement transaction.
 33. Asystem as recited in claim 29, wherein said at least one predefinednetwork transaction comprises a mobile-originated short message service(SMS) transaction.
 34. A system as recited in claim 29, wherein said atleast one predefined network transaction comprises a mobile-terminatedshort message service (SMS) transaction.
 35. A system as recited inclaim 29, wherein said at least one predefined network transactioncomprises a mobile origination transaction.
 36. A system as recited inclaim 29, wherein said at least one predefined network transactioncomprises a mobile termination transaction.
 37. A system as recited inclaim 29, wherein said at least one predefined network transactioncomprises a Release transaction.
 38. A system as recited in claim 1,wherein said system is configured to perform said detecting while saidmobile device is idle and crossing a Location Area boundary and therebycausing an automatic Location Update transaction.
 39. A system asrecited in claim 1, wherein said system is configured to perform saiddetecting while said mobile device is on a voice call.
 40. A system asrecited in claim 1, wherein said system is configured to perform saiddetecting while said mobile device is on a data call.
 41. A system asrecited in claim 1, wherein the system is configured to define a dynamicgeo-fenced area by making a change to a cell's location area code (LAC)and thereby provoking an idle mobile device to transmit and thus createa low-accuracy, cell ID-based location estimate.
 42. A system as recitedin claim 41, wherein the system is configured to use a dynamic processfor detecting a mobile device, said process comprising: initiallysetting an original LAC in the BCCH for all of a plurality of cells;changing the LAC in a selected subset of said plurality of cells;setting triggers for location update transactions; and when an idlemobile device in the geo-fenced area detects the new LAC broadcast inthe BCCH and initiates a location update transaction, detecting thelocation update transaction.
 43. A system as recited in claim 1, whereinthe system is configured to define a dynamic geo-fenced area by making achange to a cell's LAC and thereby provoking a mobile device currentlyon a call to experience a handoff or be released but allowed to redialand resume the call.
 44. A system as recited in claim 43, wherein thesystem is configured to use a dynamic process for detecting a mobiledevice, said process comprising: initially setting an original LAC inthe BCCH for all of a plurality of cells; changing the LAC in a selectedsubset of said plurality of cells; setting triggers for location updatetransactions; and when an idle mobile device in the geo-fenced areadetects the new LAC broadcast in the BCCH and initiates a locationupdate transaction, detecting the location update transaction.
 45. Asystem as recited in claim 1, wherein the system is configured to querya Home Location Register (HLR) of the wireless communications system foridentity information concerning at least one mobile device to belocated, to issue an Any Time Interrogation (ATI) message to a MobileSwitching Center (MSC) to cause the at least one mobile device totransmit a Page Response message, and to use said Page Response messageas a trigger to locate the at least one mobile device.
 46. A system asrecited in claim 1, wherein the LMS is incorporated into the wirelesscommunications system.